CuraSec

Act active

GitLab max-severity path traversal flaw has public PoC on GitHub

2026-09-11 14:58 UTC · BleepingComputer · read the source ↗ #gitlab#path-traversal#critical-cve
  • Engineer — Act: Max-severity path traversal in GitLab with a public PoC significantly raises exploitation risk even absent a KEV listing — patch all self-hosted GitLab instances to the fixed version immediately and verify no unauthorized file access occurred before the patch window.
  • SOC/IR — Act: A public PoC for a max-severity GitLab flaw means opportunistic exploitation attempts are likely imminent; hunt for anomalous file-read patterns and path traversal sequences (e.g., ../ chains) in GitLab access logs since the disclosure date.
  • Leader — Plan: Confirm whether self-hosted GitLab instances exist in the environment and verify engineering teams have prioritized patching within days given the public PoC; no board-level brief warranted yet unless active breach evidence emerges.
  • Signals: CVE-2026-85706 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.