Tag

Cve 2026 85706

All articles tagged with #cve 2026 85706

security2 hours ago•3 min saved

GitLab issues urgent patch for critical path-traversal flaw CVE-2026-85706

GitLab urges self-hosted installations to patch CVE-2026-85706, a max-severity path traversal flaw in the repository-commits API that could allow unauthenticated access to arbitrary data; patches are available in GitLab CE/EE 19.3.2, 19.2.6, and 19.1, with GitLab.com already on patched code. WatchTowr reports in-the-wild probing for exploitation, and a related issue—CVE-2026-87719 (insecure deserialization in GraphQL subscriptions)—is also fixed in these versions. Admins should upgrade immediately to protect credentials and configs; GitLab serves millions of users, including Fortune 100 companies.

via BleepingComputer|

#cve-2026-85706 #cybersecurity #gitlab

security7 hours ago•2 min saved

GitLab fixes critical path-traversal flaw after rapid in-the-wild probes

GitLab released patches for a critical path-traversal flaw (CVE-2026-85706, CVSS 10) in the repository commits API that could let an unauthenticated attacker read arbitrary server files; in-the-wild probes were observed within hours of disclosure. The fixes also address a high-severity insecure deserialization issue in GitLab EE (CVE-2026-87719). Admins should upgrade to patched versions (CE/EE 19.1.8, 19.2.6, 19.3.2) or limit internet exposure, and monitor for suspicious POST requests to /api/v4/projects/{id}/repository/commits/ containing file.Path parameters to identify exploitation attempts.

via The Hacker News|

#cve-2026-85706 #gitlab #path-traversal