CVE-2026-85706: Critical GitLab Path Traversal Flaw Exploited in the Wild

A critical, unauthenticated path traversal vulnerability (CVE-2026-85706, CVSS 10.0) in GitLab’s repository commits API allows remote attackers to read arbitrary files from self-managed, internet-facing instances (requires at least one public project). GitLab released fixes on September 10, 2026; internet-wide probes and public PoC appeared within hours, and CISA added the flaw to its KEV catalog. Organizations should urgently upgrade affected versions (19.1.8, 19.2.6, 19.3.2 or later), inspect repository commits API traffic for suspicious path requests, perform forensic triage, and rotate any potentially exposed credentials and secrets.