GCVE-110-NCSC-2026-367

Advisory PublishedCVSS 10.0/10

Vulnetix · Advisory published September 12, 2026

GitLab Community and Enterprise Editions contain a path traversal vulnerability in the repository commits API allowing unauthenticated users to read arbitrary files due to improper path confinement and missing authentication.

Download JSON Open in Console

Weaknesses (CWE)

CWE-35Path Traversal: '.../...//'

Risk Scores

CVSS 3.1

10.0/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions	Platforms
GitLab	vers:unknown/*	—	—
Open Source	vers:unknown/*	—	—

Aliases

CVE-2026-85706

References

advisory

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON