DaystoPatch

GitLabExploited incident

GitLab CE/EE path traversal in repository commits API (critical patch release 19.3.2, 19.2.6, 19.1.8)

CVE-2026-85706Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 11 Sep 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8CuratedQuote verified

    On September 10, 2026, we released versions 19.3.2, 19.2.6, 19.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).

    Coordinated disclosure (reported via HackerOne): the bug became public in the patch release itself. Exploitation probes were reported only afterwards (from 06:00 UTC on 2026-09-11 per watchTowr, as relayed by CrowdSec).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fb32e02605a46b42…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    CISA KEV (CVE-2026-85706)ClaimedQuote verified11 Sep 2026

    GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-09-11.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet11 Sep 2026, 00:17 UTC

    GitLab patched critical GitLab vulnerabilities, led by CVE-2026-85706 with a CVSS 10.0 score. Update your server now to protect source code from exposure.

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet11 Sep 2026, 00:18 UTC

    GitLab patched critical GitLab vulnerabilities, led by CVE-2026-85706 with a CVSS 10.0 score. Update your server now to protect source code from exposure. # GitLab # CVE202685706 # Vulnerabilities # DevSecOps # Cybersecurity https://

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-85706ClaimedQuote verified12 Sep 2026, 02:46 UTC

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ff7dd85123926187…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet12 Sep 2026, 08:01 UTC

    https://www.cve.org/CVERecord?id=CVE-2026-85706

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: censysClaimedQuote verified24 Sep 2026, 17:00 UTC

    Introducing Censys CLI Skills: AI-Assisted Investigations at Scale

    Earliest mention we hold (a vetted outlet).

    Source
    Research: censys research
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:94db56c07c1aa9ba…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8CuratedQuote verified

    On September 10, 2026, we released versions 19.3.2, 19.2.6, 19.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fb32e02605a46b42…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    GitLab advisory patch-release-gitlab-19-0-9-releasedClaimedQuote verified23 Sep 2026

    On September 23, 2026, we released versions 19.0.9 and 18.11.12 for GitLab Community Edition (CE) and Enterprise Edition (EE).

    From the advisory's revision history.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7cd02f5ab92f8aad…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8CuratedQuote verified

    On September 10, 2026, we released versions 19.3.2, 19.2.6, 19.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fb32e02605a46b42…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Rapid7 Emergent Threat Response (Sep 14, 2026)CuratedQuote verified10 Sep 2026

    On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2019ee94d514a0f5…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    GitLab advisory patch-release-gitlab-19-0-9-releasedClaimedQuote verified23 Sep 2026

    On September 23, 2026, we released versions 19.0.9 and 18.11.12 for GitLab Community Edition (CE) and Enterprise Edition (EE).

    GitLab.com was patched before the self-managed release

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7cd02f5ab92f8aad…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8CuratedQuote verified

    On September 10, 2026, we released versions 19.3.2, 19.2.6, 19.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).

    19.3, 19.2 and 19.1 are the three releases inside GitLab's standard security-maintenance window and all got fixes on 2026-09-10. GitLab later backported the fix to the out-of-window 19.0 and 18.11 trains ('Update: On September 23, 2026, we backported fixes for CVE-2026-85706 and CVE-2026-87719 to versions 19.0.9 and 18.11.12'). Affected 18.7-18.10 got no fix; users must upgrade.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fb32e02605a46b42…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • GitLab Community Edition (self-managed)
  • GitLab Enterprise Edition (self-managed)
How we built this timeline

Coordinated case: fixes and disclosure on 10 Sep 2026; exploitation reported from 11 Sep 2026 (CrowdSec report: 'watchTowr saw probes from 06:00 UTC', KEV listing at 19:32 UTC). exploited before a fix=false because no exploitation before the fix has been reported. Wiz's database reportedly gives 12 Sep 2026 as the disclosure/patch date;

GitLab's own page says September 10, 2026, which Rapid7 and CrowdSec match, so September 10 is used. The GitLab page gives a date only.

GitLab.com and GitLab Dedicated were already patched. Affected: GitLab CE/EE 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2.

Released together with CVE-2026-87719 (not in KEV).

Related

No related incidents.

GitLab report card