Background
GitLab servers hold source code and support the build and deployment workflows that organizations depend on. Unauthorized access to server-side files can expose information that extends an attacker’s reach into development infrastructure.
On September 10, 2026, GitLab released fixes for CVE-2026-85706, a critical path traversal vulnerability affecting GitLab Community Edition and Enterprise Edition. The issue received a CVSS score of 10.0, and GitLab subsequently confirmed its addition to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Organizations running affected self-managed instances should prioritize remediation.
Root Cause
The vulnerability involves the interaction between GitLab Workhorse, which handles incoming uploads, and the backend application. During normal upload processing, Workhorse supplies metadata that tells the application where to find a temporary file containing the uploaded data. Public research shows that differences in URL interpretation between these components can allow a crafted request to bypass the expected upload handling while still reaching a backend API endpoint.
The backend can then process client-supplied file metadata before enforcing authentication. Combined with insufficient path confinement, this allows an unauthenticated request to access local-file processing outside the intended upload workflow.
Successful exploitation can expose files accessible to the GitLab server process. Depending on permissions and deployment configuration, those files may contain credentials, tokens, configuration data, or information about the surrounding infrastructure.
RidgeBot Detection
RidgeBot’s current check uses active validation to assess whether the vulnerable behavior is reachable without authentication.
After identifying a GitLab service, RidgeBot sends a controlled probe and evaluates the application’s response for behavior associated with the flaw. This approach provides evidence beyond a version number or service banner while avoiding the collection of sensitive server files.
Affected Versions
GitLab identifies the following affected releases:
| Affected GitLab CE/EE versions | Fixed release |
|---|---|
| 18.7.0 through 19.1.7 | 19.1.8 |
| 19.2.0 through 19.2.5 | 19.2.6 |
| 19.3.0 through 19.3.1 | 19.3.2 |
GitLab recommends upgrading affected self-managed installations immediately.
Recommended Action
Security teams should inventory self-managed GitLab instances, verify their versions, and upgrade to an appropriate fixed release or later supported version. Where patching cannot be completed immediately, restricting network access can reduce exposure temporarily.
Review historical API traffic and application logs for suspicious file-access activity. GitLab has published threat detections to help self-managed customers investigate exploitation attempts.
If investigation suggests that sensitive information was exposed, assess the affected credentials and connected systems as part of incident response. After remediation, repeat validation and verify the installed version.
RidgeBot helps security teams validate CVE-2026-85706 exposure safely and automatically, enabling defenders to identify exploitable systems quickly and prioritize remediation based on real risk.