GitLab Community Edition and Enterprise Edition · Path traversal
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on GitLab Community Edition and Enterprise Edition, treat it as High.
Briefing
- IT leaders should verify if their GitLab instances are running affected versions and apply the necessary updates to mitigate the risk of exploitation.
Questions to ask IT
- Do we run GitLab Community Edition and Enterprise Edition, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 10 Nov?
Next steps
- Confirm exposure and remediation status for affected products
Vulnerability facts
Full CVE detail CVE-2026-85706- 10.0 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality and integrity, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- Listed: attacks using it have been seen
- Elevated attack likelihood (~97.4% in 30 days)
- 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
- 18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.2
- Not linked from the CVE record
These facts are for CVE-2026-85706. This event covers 1 more CVE, each with its own record. Versions are as the CVE record states them; check the vendor advisory before planning a fix.
- CVE-2026-85706 is confirmed as exploited in the wild according to the US known-exploited catalogue.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- GitLab Community Edition and Enterprise Edition have released updated versions to address two critical vulnerabilities, CVE-2026-85706 and CVE-2026-87719, which were originally patched on 10 September 2026.
- The updates, versions 19.0.9 and 18.11.12, allow self-managed administrators to apply fixes without completing a full version upgrade.
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- GitLab Community Edition and Enterprise Edition98% match confidence · CVE-2026-85706
Part of GitLab vulnerability disclosures
Pulse
Last checked 21h ago · Next recheck 8 Nov 2026, 17:36 UK time
- Story3 Nov 2026, 18:20 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases) - Story3 Nov 2026, 18:20 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases)
2 entries so far. The timeline chart appears once this story has more history.
Sources
- GitLab security releasesVendor
GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
- GitLab security releasesVendor
GitLab Critical Patch Release: 19.0.9, 18.11.12
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- ProbableSummary fact75% confidence
On 23 September 2026, we released versions 19.0.9 and 18.11.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions backport the fixes for two critical vulnerabilities, CVE-2026-85706 and CVE-2026-87719, that were originally patched in 19.3.2, 19.2.6, and 19.1.8 on 10 September 2026.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-85706
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2026-85706 is confirmed as exploited in the wild (US known-exploited catalogue)
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-87719