GitLab CE/EE Path Traversal Flaw Rated CVSS 10, Security Patch Released

GitLab CE/EE has a critical path traversal vulnerability, CVE-2026-85706, with a CVSS score of 10. According to ChainCatcher, unauthenticated attackers could use the Repository Commits API to read arbitrary files on affected GitLab servers. GitLab has released a security patch. Affected versions include releases from 18.7 to before 19.1.8, from 19.2 to before 19.2.6, and from 19.3 to before 19.3.2. Self-managed GitLab users are advised to upgrade immediately to 19.1.8, 19.2.6, or 19.3.2 and check logs and any potentially exposed credentials after patching.