Critical GitLab Path Traversal Vulnerability Allows Unauthenticated Arbitrary File Read

On 2026-09-10 GitLab released emergency patches for CVE-2026-85706, a critical path traversal and missing-authentication flaw in the repository commits API of self-managed GitLab CE/EE that allows an unauthenticated attacker to read arbitrary files via a crafted POST to /api/v4/projects/{id}/repository/commits/ (file.path). Affected versions and patched releases (19.1.8, 19.2.6, 19.3.2) are listed; watchTowr observed probing consistent with a working exploit about one day after the patch, so organizations should immediately upgrade, restrict internet access, apply WAF/reverse-proxy rules, review logs for suspicious POSTs to the commits API, and rotate any potentially exposed secrets.