CVE-2026-85706 lets attackers read arbitrary files from vulnerable GitLab servers in a single HTTP request, hitting CE and EE releases before 19.1.8, 19.2.6 and 19.3.2.
GitLab said improper confinement and missing authentication checks in the repository commits API created the path traversal bug, and urged public-facing self-hosted users to patch immediately or remove internet access.
CISA has added the flaw to its Known Exploited Vulnerabilities catalog, while watchTowr said it is already seeing in-the-wild probes and warned broad exploitation may follow quickly.
Because GitLab is used by about 50% of the Fortune 100 and more than 50 million registered users, exposed files could include secrets, tokens and credentials that enable lateral movement, source-code theft and supply-chain compromise.
The disclosure is GitLab’s second major flaw in a month, following an August bug that allowed unauthenticated repository changes or deletion with one HTTP request.