# GitLab path traversal flaw exploited in the wild

Published: 2026-09-14 · Severity: severe · Sectors: technology, government-national
Canonical: https://vorant.io/reports/b85bcd50-84e1-558e-b723-17308e65e992/gitlab-path-traversal-flaw-exploited-in-the-wild

> An actively exploited GitLab path traversal bug lets attackers read arbitrary files via the repository commits API, exposing SSH keys and credentials.

MS-ISAC has issued an advisory for a path traversal vulnerability (CVE-2026-85706) in GitLab's repository commits API, affecting all Community and Enterprise Edition versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. A single crafted HTTP request against the vulnerable API endpoint can allow an attacker to read arbitrary files on the server, potentially disclosing SSH keys, database credentials, deploy tokens, and CI/CD variables.

The advisory notes this vulnerability is actively being exploited in the wild, making it a priority patching item for any organization running self-hosted GitLab instances in the affected version ranges. Depending on what sensitive data is retrieved, an attacker could pivot to further compromise of the GitLab appliance or connected systems (e.g., via stolen deploy tokens or database credentials), potentially enabling supply-chain style attacks on downstream CI/CD pipelines.

Defenders should apply the vendor-provided stable channel update immediately after testing, restrict external exposure of GitLab instances where possible, and monitor for anomalous API requests to the commits endpoint. Standard hardening measures such as least privilege, vulnerability scanning of externally-exposed assets, and host-based intrusion detection are recommended alongside patching.

## Mentioned in this report

- Vulnerabilities: CVE-2026-85706 (KEV)

## Detection guidance (public sample)

### GitLab Repository Commits API Path Traversal Exploitation

ATT&CK: T1190

Detects suspicious HTTP requests to GitLab commits API endpoint with path traversal patterns (../ sequences or encoded variants) attempting to read sensitive files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GitLab Repository Commits API Path Traversal Exploitation
description: Detects HTTP requests to GitLab repository commits API endpoints containing
  path traversal sequences (../ or URL-encoded variants %2e%2e) commonly used to exploit
  CVE-2026-85706. Targets the distinctive API pattern without over-fitting to specific
  file paths.
tags:
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection_api_path:
    c-uri|contains: /repository/commits
  selection_traversal:
    c-uri|contains:
    - ../
    - ..\
    - '%2e%2e/'
    - '%2e%2e%5c'
  condition: selection_api_path and selection_traversal
falsepositives:
- Legitimate developer tools or scripts performing repository introspection with malformed
  paths
- API testing frameworks that inadvertently encode traversal patterns
level: high
id: 3627561a-2496-54e9-8a9d-52ae0c783fe6
status: experimental
author: Vorant
```

### GitLab Commits API Request Reading Sensitive Configuration Files

ATT&CK: T1190

Detects HTTP requests to GitLab commits API attempting to access typical sensitive file paths (.ssh, .env, database config, secrets) via path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GitLab Commits API Request Reading Sensitive Configuration Files
description: Detects HTTP requests to GitLab repository commits API endpoints attempting
  to read sensitive system or configuration files (SSH keys, environment variables,
  database configs, credentials) via path traversal. Focuses on the distinctive sensitive
  file patterns rather than one-off paths.
tags:
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection_api:
    c-uri|contains: /repository/commits
  selection_sensitive_paths:
    c-uri|contains:
    - .ssh/
    - .env
    - database.yml
    - secrets.yml
    - credentials
    - id_rsa
    - config/database
    - /root/
    - /home/
  condition: selection_api and selection_sensitive_paths
falsepositives:
- Legitimate GitLab documentation or config file review endpoints
- Authorized backup or configuration management tools querying file paths
level: high
id: d09c12ea-af5e-5ec1-ac0c-17d0a13281a6
status: experimental
author: Vorant
```

### Anomalous HTTP GET Requests to GitLab Commits API Endpoint

ATT&CK: T1190

Detects HTTP GET requests to GitLab commits API endpoint from unusual source IPs or with abnormally high request rate, indicative of active exploitation scanning. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Anomalous HTTP GET Requests to GitLab Commits API Endpoint
description: Detects HTTP GET requests targeting GitLab repository commits API endpoints
  (/api/v*/projects/*/repository/commits) with indicators of automated exploitation
  scanning, such as absence of typical User-Agent headers or referer patterns common
  to legitimate GitLab web interface usage.
tags:
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection_api:
    c-uri|contains: /repository/commits
    cs-method: GET
  filter_legitimate_ua:
    cs-User-Agent|contains:
    - Mozilla
    - GitLab
    - Chrome
    - Safari
  filter_localhost:
    cs-host|contains:
    - 127.0.0.1
    - localhost
    - ::1
  condition: selection_api and not filter_legitimate_ua and not filter_localhost
falsepositives:
- Curl/wget-based legitimate API calls by developers or automation tools
- API documentation tools without standard User-Agent headers
level: medium
id: 1b11d12d-f935-56cb-96b2-08a0c169aa37
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-gitlab-could-allow-for-disclosure-of-sensitive-data_2026-094

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b85bcd50-84e1-558e-b723-17308e65e992/gitlab-path-traversal-flaw-exploited-in-the-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup