Security Feed
See the latest insights and analysis from our MDR team.
RSS for Slackcve-2026-85706
By Nevo Evenhaim |
11 September 2026
GitLab repository commits API path traversal allows unauthenticated arbitrary file read
GitLab CE/EE repository commits API improper path confinement and missing auth checks allow unauthenticated path traversal to read arbitrary files from the GitLab server. Affects CE/EE 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Patch by upgrading to 19.1.8, 19.2.6, or 19.3.2 immediately.