A path-traversal vulnerability in GitLab CE/EE (versions 18.7+) allows unauthenticated attackers to read arbitrary files from self-managed servers. Patches released Sept 10; CISA added to Known Exploited Vulnerabilities catalog with reported in-the-wild exploitation.
Maximum-severity vulnerability with real-world attacks on widely used DevOps platform poses high risk for source code and credential theft. Timely patching is critical for self-hosted instances, making this a top-priority security alert for administrators and enterprises.
CVE-2026-85706. Unauthenticated attacker reads any file off your self-hosted GitLab. CVSS 10.0. Already on CISA's KEV. Already being exploited before most teams saw the advisory. If you self-host GitLab to save money as a solo dev, this is the bill. Patch: 19.1.8 / 19.2.6 /…
166
2 posts, first seen 5h ago
A path-traversal vulnerability in GitLab CE/EE (versions 18.7+) allows unauthenticated attackers to read arbitrary files from self-managed servers. Patches released Sept 10; CISA added to Known Exploited Vulnerabilities catalog with reported in-the-wild exploitation.
Maximum-severity vulnerability with real-world attacks on widely used DevOps platform poses high risk for source code and credential theft. Timely patching is critical for self-hosted instances, making this a top-priority security alert for administrators and enterprises.
CVE-2026-85706. Unauthenticated attacker reads any file off your self-hosted GitLab. CVSS 10.0. Already on CISA's KEV. Already being exploited before most teams saw the advisory. If you self-host GitLab to save money as a solo dev, this is the bill. Patch: 19.1.8 / 19.2.6 /…
Allaboutclait@allaboutclaitCISA: Hackers now exploit max severity GitLab flaw in attacks #infosec
Allaboutclait@allaboutclaitCISA: Hackers now exploit max severity GitLab flaw in attacks #infosec
Not enough discussion yet.
No sentiment analysis available yet.
Not enough discussion yet.
No sentiment analysis available yet.
#3
#3