DEV TOOLS Signal 54
Attackers exploit maximum-severity GitLab path traversal bug days after patch release
↗
CISA confirms active exploitation of a CVSS 10.0 GitLab flaw allowing unauthenticated file access on unpatched servers
A critical GitLab vulnerability is being actively exploited, exposing source code, credentials, and configuration files on unpatched self-hosted instances. The flaw’s simplicity and severity make rapid patching essential for any exposed deployment. Failure to upgrade leaves sensitive data accessible to unauthenticated attackers with minimal effort.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The flaw affects GitLab Community and Enterprise Editions, enabling unauthenticated file access via a path traversal bug in the repository commits API
GitLab released patches on September 10, but CISA and security firms report active exploitation and probing of internet-facing servers
Exploitation requires only a single HTTP request, making it trivial for attackers to extract local files, credentials, and other secrets
THE READ
What the cluster adds up to.
A maximum-severity vulnerability in GitLab is under active attack, just days after patches were released. The flaw, tracked as CVE-2026-85706, allows unauthenticated attackers to read arbitrary files from vulnerable servers by exploiting a path traversal bug in the repository commits API. GitLab rates the issue a perfect 10.0 on the CVSS scale, reflecting its critical impact and ease of exploitation.
The vulnerability stems from improper path confinement and missing authentication enforcement in the affected API. This combination is particularly dangerous for GitLab instances, which often store source code, configuration files, and credentials. Attackers can exploit the flaw with a single HTTP request, making it trivial to access sensitive data without prior authentication or complex tooling.
GitLab released fixes on September 10 for affected versions, but CISA has since added the flaw to its Known Exploited Vulnerabilities catalog. Security firm watchTowr reports observing probes for the vulnerability in the wild, indicating that widespread exploitation is likely imminent. Organizations running self-hosted, internet-facing GitLab instances are urged to patch immediately or restrict public access to mitigate risk.
The simplicity of the exploit and the severity of the flaw make it a high-priority target for attackers. Admins investigating potential exploitation should check logs for HTTP POST requests to the affected API endpoint containing file.path parameters. While GitLab.com and GitLab Dedicated customers are already protected, self-managed instances remain vulnerable until patched, leaving sensitive data exposed to unauthenticated access.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER