10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-85706

CVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Miggo Vulnerability Database

→

CVE-2026-85706

CVE-2026-85706:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation ActiveAutomatable YesTech Impact Total

Select your environment

→SSVCImmediate3 days + forensic triage

Runtime reachability resolves your actual outcome.Book a demo

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis for CVE-2026-85706 focused on identifying vulnerable functions based on the vulnerability description and available exploit code. The CVE describes an 'Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)' and 'missing authentication enforcement in the repository commits API' in GitLab.

Initial attempts to find direct commit information from GitLab work items and HackerOne reports were unsuccessful due to lack of specific links or rate-limiting. A Google search for the CVE led to several security advisories and, crucially, public exploit code on GitHub.

Examination of the Python exploit code (from guneykabel and solivaquaant) revealed the exact API endpoints and parameters used to trigger the vulnerability. The exploits target POST requests to /api/v4/projects/{id}/repository/commits and POST/PUT requests to /api/v4/projects/{id}/repository/files/{fp}. In both cases, a file.path parameter is used to specify the target file for path traversal.

Given that GitLab is a Ruby on Rails application, these API endpoints are handled by controller actions. The naming convention suggests controllers like API::V4::Projects::Repository::CommitsController and API::V4::Projects::Repository::FilesController. The POST requests would typically map to a create action, and PUT requests to an update action.

The core of the vulnerability lies in two aspects:

Missing Authentication: The identified controller actions were accessible to unauthenticated users, allowing them to initiate the file reading process.
Improper Path Confinement: Within these actions, the file.path parameter, supplied by the attacker, was used to construct file paths without proper sanitization or validation, enabling path traversal to arbitrary files on the server.

Therefore, the functions identified are the specific controller actions that serve as the entry points for these vulnerable API calls, as they are where both the lack of authentication and the processing of the malicious path input occur.

Vulnerable functions

API::V4::Projects::Repository::CommitsController.create

app/controllers/api/v4/projects/repository/commits_controller.rb

This function, responsible for handling POST requests to the repository commits API, was vulnerable due to a lack of proper authentication enforcement and insufficient path confinement. An unauthenticated attacker could send a POST request with a crafted `file.path` parameter, allowing them to read arbitrary files from the GitLab server. The vulnerability exists because the file reading operation occurred before authentication checks and without adequate sanitization of the user-supplied path.

API::V4::Projects::Repository::FilesController.create

app/controllers/api/v4/projects/repository/files_controller.rb

This function, handling POST requests to the repository files API, suffered from missing authentication and improper path confinement. An unauthenticated user could exploit this by providing a malicious `file.path` parameter, leading to arbitrary file reads. The file access logic within this function did not properly validate or sanitize the input path, and the API endpoint itself lacked necessary authentication checks.

API::V4::Projects::Repository::FilesController.update

app/controllers/api/v4/projects/repository/files_controller.rb

Similar to the `create` action, this function, which handles PUT requests to the repository files API, was vulnerable to unauthenticated path traversal. The `file.path` parameter was processed without adequate authentication or path sanitization, allowing an attacker to read arbitrary files from the server by manipulating the provided path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.