GitLab CVE-2026-85706

Exploitation targets the GitLab repository commits API on self-managed GitLab CE/EE versions 18.7 through the pre-fix releases (before 19.1.8/19.2.6/19.3.2); the vector is AV:N/AC:L/PR:N/UI:N, so no authentication, no user interaction, and network reachability of the GitLab web interface are the only hard requirements. The description's 'under certain conditions' qualifier indicates some deployment/state precondition may gate the file read, but it is not specified in the available data; limiting factors are therefore essentially only that the instance must be network-accessible and running an unpatched affected version.

Every signal points to maximum priority: the CVSS vector is AV:N/AC:L/PR:N/UI:N (remote, low-complexity, unauthenticated, no user interaction), CISA KEV confirms active in-the-wild exploitation, and a public exploit is available on HackerOne (#3909881). That combination - network-reachable, unauthenticated, KEV-listed, POC-published - is the profile of a mass-scannable vulnerability, so operators of any size, from large enterprises to a small self-hosted team in zabrze, should treat this as an emergency. One caveat: the input scores I:H (high integrity impact) and A:N, but the description describes only arbitrary file *reading*, which is a confidentiality impact; the integrity rating appears overstated, and my independent assessment treats this as confidentiality-only. The 'certain conditions' qualifier in the description hints at some preconditions, but with KEV + POC the practical risk is that exploitation is already automated.

A remote attacker with no credentials sends a crafted request to the repository commits API containing path-traversal sequences, causing GitLab to return the contents of an arbitrary server file such as the gitlab-rails secrets file or environment configuration. Using leaked secrets/tokens, the attacker pivots to authenticated access or forges sessions. Public exploit code exists and the flaw is confirmed exploited in the wild (CISA KEV).