Critical GitLab Path‑Traversal Bug Threatens Software Supply Chains

A newly disclosed vulnerability identified as CVE-2026-85706 has earned a perfect 10.0 score on the Common Vulnerability Scoring System, signaling an extremely severe flaw that could be exploited to compromise GitLab installations.

The flaw is a path‑traversal defect that affects both the free Community Edition and the paid Enterprise Edition of GitLab, a platform widely used for source‑code management, continuous integration, and DevOps pipelines. By manipulating file paths, an attacker could potentially read or overwrite arbitrary files on the server, opening the door to broader system compromise.

Security researchers highlighted the issue in a report originally published by Dark Reading, noting that the vulnerability could be leveraged to infiltrate software supply chains that rely on GitLab for code storage and automated builds. Because many organizations integrate GitLab into their deployment workflows, a successful exploit could allow malicious code to be introduced early in the development lifecycle, making detection difficult.

Industry analysts stress that the risk extends beyond the immediate host. Compromised repositories can serve as a vector for downstream attacks on downstream users, customers, and partners who pull code from affected GitLab instances. This cascade effect underscores why the CVSS rating is at the maximum level.

While GitLab has not yet released a public patch at the time of this writing, the company’s security advisory recommends that administrators apply available mitigations, such as restricting file‑system access for the GitLab service account, enforcing strict input validation, and monitoring logs for suspicious path‑traversal attempts. Organizations are also urged to review their backup and incident‑response plans in case the vulnerability is exploited.

Experts advise that entities using GitLab conduct immediate inventories of their deployments, verify version numbers, and stay alert for further guidance from the vendor. Given the potential impact on global software supply chains, the flaw is expected to receive close scrutiny from both the open‑source community and enterprise security teams as they work to contain any exposure.