{
 "Event": {
  "uuid": "df93c624-4dac-5413-a1f3-71ded88e6b63",
  "info": "GitLab maximum-severity path traversal exploited within hours of disclosure",
  "date": "2026-09-11",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"supply_chain\""
   },
   {
    "name": "misp-galaxy:country=\"united states\""
   },
   {
    "name": "misp-galaxy:country=\"united kingdom\""
   },
   {
    "name": "misp-galaxy:country=\"germany\""
   },
   {
    "name": "misp-galaxy:country=\"japan\""
   },
   {
    "name": "misp-galaxy:country=\"india\""
   },
   {
    "name": "misp-galaxy:country=\"singapore\""
   },
   {
    "name": "misp-galaxy:sector=\"Technology and Software Supply Chain\""
   },
   {
    "name": "misp-galaxy:sector=\"Financial Services\""
   },
   {
    "name": "misp-galaxy:sector=\"Government\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/gitlab-maximum-severity-path-traversal-exploited-within-hours-of-disclosure/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in the GitLab repository commits API, came under in-the-wild probing from 06:00 UTC on 11 September 2026 according to watchTowr, the same day CISA added it to the KEV catalog. Exploitation requires only that a single public project exists and allows arbitrary file reads of logs, configuration files, credentials and secrets. Successful exploitation creates a direct path to source code theft and CI/CD pipeline compromise. Patches are available in 19.3.2, 19.2.6 and 19.1.8, with a 14 September federal remediation deadline.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}