onyx --cves cve-2026-85706

CVE-2026-85706

score: 31.8
cvss: —
epss: 92.0% ▼1.0
published: —
kev added: 2026-09-11
first seen: 2026-10-21

GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2026-09-11 Added to CISA KEV
2026-09-23 First advisory — GitLab security releases GitLab Critical Patch Release: 19.0.9, 18.11.12
2026-09-25 EPSS ≥ 10 % from 9.3 %
2026-09-25 EPSS ≥ 50 % from 9.3 %
by 2026-10-21 Tracked by Onyx
by 2026-10-21 Nuclei template GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read

Nuclei template

A verified check exists — you can scan for this today, and so can everyone else.

template: GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
github: projectdiscovery/nuclei-templates/http/cves/2026/CVE-2026-85706.yaml ↗
severity: CRIT
first seen: 2026-10-21

$ nuclei -id CVE-2026-85706 -u https://target.example

Advisories

0 feeds this week

ADV GitLab Critical Patch Release: 19.0.9, 18.11.12 GitLab security releases · 2026-09-23

Weaknesses

CWE-35