Critical Path Traversal Vulnerability Disclosed in GitLab CE/EE

A critical path traversal vulnerability, tracked as CVE-2026-85706, has been assigned a CVSS score of 10.0, the maximum possible rating. The flaw affects both GitLab Community Edition and GitLab Enterprise Edition instances. According to the advisory, the vulnerability could allow an attacker to access files and directories outside the web root, potentially leading to unauthorized reading of sensitive configuration files, source code, and credentials. GitLab has confirmed that the flaw poses a significant risk to software supply chains, as compromised instances could be leveraged to manipulate CI/CD pipelines or inject malicious artifacts. The vulnerability was disclosed on September 14, 2026, and reports indicate active exploitation in the wild. GitLab has released security updates addressing CVE-2026-85706. Users are strongly advised to upgrade to the latest patched version immediately. The full security advisory from GitLab provides detailed guidance on mitigation and version requirements.