Critical GitLab Path‑Traversal Flaw Exploited Within 24 Hours of Public Disclosure

A critical path‑traversal vulnerability in GitLab’s self‑hosted platform was actively exploited by unauthenticated threat actors just one day after the flaw was publicly disclosed, security outlet SecurityWeek reported.

The defect allows an attacker to manipulate file‑system paths in order to retrieve any file stored on the GitLab server. Because the exploit does not require valid credentials, it bypasses typical access controls and can expose configuration files, source code, and potentially sensitive data such as API keys or internal documentation.

GitLab, a widely adopted DevOps suite that combines source‑code management, CI/CD pipelines, and project tracking, powers thousands of private and public repositories for enterprises, open‑source projects, and government agencies. Its central role in software development pipelines makes any compromise particularly concerning, as attackers can gain insight into proprietary code or inject malicious changes downstream.

The vulnerability was first disclosed publicly, prompting GitLab to issue an advisory and advise customers to apply the forthcoming patch. Within 24 hours, threat actors were observed probing vulnerable installations, confirming that the window between disclosure and active exploitation can be extremely narrow for high‑severity flaws.

Security experts warn that the ability to read arbitrary files can lead to a cascade of secondary attacks. Access to configuration files may reveal database credentials, SSH keys, or internal network topology, enabling lateral movement or privilege escalation. For organizations that host critical codebases on-premises, the risk extends beyond data leakage to potential sabotage of build pipelines.

GitLab responded by releasing a security update that sanitizes the affected file‑path handling logic and by recommending that administrators apply the patch immediately, enforce network segmentation, and monitor logs for anomalous file‑access patterns. The company also reminded users to rotate any credentials that might have been exposed prior to remediation.

The incident underscores a broader challenge in the software supply chain: the need for rapid detection, disclosure, and patch deployment. When a vulnerability is classified as critical, the time between public notice and exploitation can shrink dramatically, leaving organizations with limited remediation time.

Administrators are urged to verify that their GitLab instances are running the latest version, to enable automated security updates where possible, and to review access logs for signs of unauthorized file reads. Ongoing vigilance and a robust incident‑response plan remain essential to mitigate the impact of such high‑profile vulnerabilities.