GitLab CE and EE Repository Commits API Path Traversal Allows Unauthenticated Arbitrary File Read (CVE-2026-85706)

Scope: GitLab Community Edition and Enterprise Edition Self-Managed Installations (GitLab.com and Dedicated Already Patched)

Severity: Red

CVE-2026-85706 is a path traversal vulnerability in the GitLab repository commits API rated CVSS 10.0 that could allow an unauthenticated user to read arbitrary files from the GitLab server under certain conditions. On self-managed GitLab instances where open registration is enabled, this effectively allows any unauthenticated visitor to read sensitive server-side files including configuration files, secrets, environment variables, and potentially SSH private keys accessible to the GitLab process user, enabling further lateral movement into connected infrastructure. On shared hosting servers where many customers' sites run on a single GitLab instance, an attacker with one hosted account could exploit the flaw to access or alter other sites and the server itself. Self-managed GitLab administrators must apply the latest patched release immediately, restrict external access to the repository commits API endpoint on internet-facing instances, and disable open registration where not operationally required as a defense-in-depth measure. 

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.