A trivially exploitable, unauthenticated path traversal flaw in GitLab has been actively weaponized, demanding immediate patching for all self-hosted instances.
GitLab has urgently patched a critical security vulnerability, CVE-2026-85706, that allows attackers to read arbitrary files from a server with a single HTTP request and no authentication required. Disclosed on September 10, 2026, the flaw carries a maximum severity CVSS score of 10.0 and affects the platform's repository commits API. Exploitation in the wild began within 24 hours of the public disclosure.
The vulnerability's danger lies in its simplicity. An attacker can craft a specific request to traverse the server's filesystem via a path traversal bug, granting full read access to sensitive resources like source code, configuration files, and credentials. This zero-click vector poses a severe risk, particularly for self-hosted GitLab Community Edition (CE) and Enterprise Edition (EE) installations. The GitLab-managed SaaS and cloud platform is not affected.
DevOps and system administration teams must identify all self-managed GitLab deployments and apply the security patches without delay.
Patched Versions and Mitigations
Patches were released on September 10. Organizations should update to the following fixed versions immediately: * GitLab CE/EE 17.x: Update to 17.2.3 * GitLab CE/EE 16.x: Update to 16.11.5
For instances that cannot be patched immediately, temporary mitigation is critical. Experts recommend restricting network access to the repository commits API endpoint. Administrators should also audit logs for signs of compromise, such as anomalous file read requests.
The swift weaponization of this flaw highlights the persistent threat to development infrastructure. Compromised GitLab servers can expose not only code but also CI/CD pipelines, private keys, and deployment credentials, potentially serving as a gateway to broader corporate networks. This patch must be treated as non-negotiable, as the window between disclosure and mass exploitation is extremely narrow.
GitLab中一個極易利用且無需認證的路徑遍歷漏洞已被積極武器化，所有自託管實例必須立即進行修補。
GitLab已緊急修補一個編號為CVE-2026-85706的嚴重安全漏洞。該漏洞容許攻擊者透過單一HTTP請求，無需任何認證即可讀取伺服器上的任意檔案。此漏洞於2026年9月10日披露，CVSS嚴重性評分為最高級別的10.0分，影響該平台的儲存庫提交API。漏洞在公開披露後24小時內已在現實中被利用。
此漏洞的危險之處在於其簡單性。攻擊者可建構特定請求，利用路徑遍歷漏洞穿越伺服器的檔案系統，從而獲得對原始碼、設定檔案及憑證等敏感資源的完整讀取權限。這種零點擊攻擊向量風險極高，尤其對自託管的GitLab社區版（CE）及企業版（EE）安裝影響顯著。GitLab管理的SaaS及雲端平台則不受影響。
DevOps及系統管理團隊必須找出所有自行管理的GitLab部署，並毫不延遲地套用安全修補程式。
已修補版本及緩解措施
修補程式已於9月10日發布。各機構應立即更新至以下已修正版本： * GitLab CE/EE 17.x：更新至17.2.3 * GitLab CE/EE 16.x：更新至16.11.5
對於無法立即修補的實例，實施臨時緩解措施至關重要。專家建議限制對儲存庫提交API端點的網路存取。管理員亦應審核日誌，查找入侵跡象，例如異常的檔案讀取請求。
此漏洞迅速被武器化，突顯了對開發基礎設施的持續威脅。被入侵的GitLab伺服器不僅會暴露代碼，還可能洩露CI/CD管線、私鑰及部署憑證，進而成為入侵更廣泛企業網路的跳板。鑑於漏洞從披露到大規模利用的時間窗口極短，此次修補必須被視為不可妥協的必要措施。