# GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

> **Open Intelligence Dossier** · First detected: 2026-09-11 23:07 UTC · Category: Technology

## Executive Summary
GitLab has issued an emergency update for a CVSS 10 vulnerability enabling arbitrary file reads and remote code execution following reports of active exploitation.

## Intelligence Brief
GitLab has released an emergency security update to address a maximum-severity path traversal vulnerability identified as CVE-2026-85706. This critical flaw involves the Commits-API and allows an attacker to access every file on a server using a single HTTP request. According to reports from CyberPress and other outlets, the vulnerability enables arbitrary file reads, the theft of credentials, and remote code execution. The severity of the flaw is reflected in its CVSS score of 10, the highest possible rating for security vulnerabilities. Coverage of the event is widespread across technical and security news platforms. BleepingComputer reports that GitLab is urgently calling on its users to apply the necessary patches.


The Hacker News and CyberScoop emphasize that the flaw began drawing internet-wide probes almost immediately following its disclosure. Forkast.news specifically highlights the speed of the threat, stating that active exploitation began within hours of the vulnerability becoming known. Field Effect also notes the commencement of these internet-wide probing activities as GitLab worked to fix the flaw. This situation is critical because GitLab servers often host sensitive source code and infrastructure secrets. The ability for an external actor to perform arbitrary file reads via a path traversal flaw in the Commits-API creates a direct path to credential theft. As noted by watchTowr in their rapid reaction analysis, the technical nature of the flaw allows for significant system compromise.


Because the vulnerability allows for remote code execution, the stakes involve the total takeover of affected server environments, necessitating the emergency nature of the patch. Future developments will depend on the rate of user adoption for the emergency security update. While GitLab has already issued the fix, the ongoing internet-wide probes reported by CyberScoop and The Hacker News suggest that attackers are actively seeking unpatched systems. WatchTowr and other security monitors will likely continue tracking the activity surrounding CVE-2026-85706 to determine the scale of successful exploitations. Users are expected to prioritize the update to prevent the credential theft and remote code execution capabilities identified in the coverage.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| LinkedIn | GitLab Issues Emergency Security Update For Maximum-Severity Vulnerability | [Source Link](https://news.google.com/rss/articles/CBMimAFBVV95cUxQZ3BaaF9VS0FLRGJvNmxPY21GNUhOSkRBYnlkaFhQOVhqSjRPWks0Z25kNmM1V2czYUVvNGFaQm9pYzFSTFNXZ1pEdmZBS0hJNnFyemxpRXlvbUx5c0ktUmRTdkJwdERwaEpET3hId2tEUE96LU9BZUZkaFBtalVhakhLdmp2QTJBR3lZRGZPNVVBa2FVd1dVaA?oc=5) |
| forkast.news | One HTTP Request, Every File on the Server: GitLab’s CVSS 10 Commits-API Flaw Hits Active Exploitation Within Hours | [Source Link](https://news.google.com/rss/articles/CBMizwFBVV95cUxOcllBVXRnb01JbGFSUFNjRlA4eHZKanJkMDkwcGtzRUFFZDZNTm9mSHRQUUZuNUlUM0RsSjBDay13TmEtNVUxZnFFbGZZb2RJQ3lEbU56YXpJUU1SMnU4dVplV2hNSVVvUnAzOFhZdlNwX053NGFWb0REaUlYUTdmbWR5aWJ2VGRFTlNYVDh5RTVIbUFHdlhqVmNIcm5RZ3REeVN4WENNV0FrSXppNjktU04wYUotUEVQcnRKYm16c3Vza2FPMm5YN2kzLUcyRFE?oc=5) |
| CyberScoop | GitLab’s critical flaw is already drawing internet-wide probes | [Source Link](https://news.google.com/rss/articles/CBMidEFVX3lxTFBVeUc5Y29nTlJKcnRVNFVmclpUODNaa2RkbGgtXzlTX2FCb1cxQzVDY0dxWE50ekJ0RGFMRWp3OHFHY05QOXlkLTYxQXdCNFVUZzdVX2U5RXJLbVJHTEhVSHFhX1NzOGJWeEtpQndIaGxwTVBG?oc=5) |
| fieldeffect.com | GitLab fixes critical vulnerability as internet-wide probing begins | [Source Link](https://news.google.com/rss/articles/CBMihgFBVV95cUxQLWlvbkNhdnJHdVMzSm1STlFLOWpMZmdmODgyQlhUeHJPYWdmWWtuZGFnWFFzSnhfdkN2N241WTJ3c3p4RHZ2cUJ6X1VrLWhUZDNGYWprZFN4UWlHbVZnNlA4VkJpSkcxVHY1akVobUVXMG1SYW54OFhzbFhQRS1WbDN6eHA5UQ?oc=5) |
| cyberpress.org | GitLab Patches Critical Flaws Enabling Arbitrary File Read, Credential Theft and Remote Code Execution | [Source Link](https://news.google.com/rss/articles/CBMiwwFBVV95cUxPWjZSVElwWXdGNFJBRHRHWkNmVUZWVlcwZW5pM01ZN0FEYjFXV1lJTEswbVhGUkRzOXRqQTZxN3hGS3RRN3NNbi01clViMkZGS0ptQnNwUU4xN25ldHJrZU9lWEtENkppdi1wcU9UVzFFRk4xYl81d1NtMjh4NXZPeXJZUFNvV2RiV3c4LTdRaDA1ODAwSFlNWldfcDVmeGFUWEhMTzhtczktTFNGUHkxZUR6M3J6YW5QXzFvNGRjdUw3aE3SAcMBQVVfeXFMT1o2UlRJcFl3RjRSQUR0R1pDZlVGVlZXMGVuaTNNWTdBRGIxV1dZSUxLMG1YRlJEczl0akE2cTd4Rkt0UTdzTW4tNXJVYjJGRktKbUJzcFFOMTduZXRya2VPZVhLRDZKaXYtcHFPVFcxRUZOMWJfNXdTbTI4eDV2T3lyWVBTb1dkYld3OC03UWg) |
| watchTowr | Rapid Reaction: GitLab Path Traversal Vulnerability (CVE-2026-85706) | [Source Link](https://news.google.com/rss/articles/CBMiqwFBVV95cUxPaThMQUxuVl9pQ3ZFR1plbkFIOHc0bEZ5TDFucEdNbnZtS1l0dzhJdlhqNlBINVNJaDNpU1QxOTdtNDlFUG5STzYyVnppeDJkazh4c0VkczJIMG92SVFCb0VSc0g0TVUwOU9yU2R3U040cmRIYUFscWpDUnN1SG9CUE9ySDVNN01xalFPdzktS1Rsd25IeTh2LXNaMTFFN1pUZmJtWFBpdV91MFk?oc=5) |
| BleepingComputer | GitLab urges users to patch max severity path traversal flaw | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxPVzlTZzdUMi1YZzgyZWNzNFQ4c3FNdjEyZ19JSnhwQW9faEthSkYxM3ZsN3pMT3VjZ01sanppbUxEUVZQOWhZWE9IWk0wTnpiMXp6MnJPd1pvVklKMUNRTXo4dFFFVVcxMTdyQm5BUXZSXzVuX0J0UThkUWdHa2Qwc3AydzhueG5meU05R2RYaHVKR3doMUZEZEc5Q293eTk1cXVfMGhYb2dUa3Zv0gGyAUFVX3lxTE9DTmpMV3NNcElqaW9ySDRSeFpWci05T3hVUmdpQ3VIU2d2YWg3T3dxYXA1ejdwdzVhX3lBLWVwMzhXQ19HbjFQcE9QSG5LVVRPaXhUbzBGM0ZYNnVPS2tFOUVuYm9QWTlidVcxZ1kyeEFDS01HNEZTaXVtZm12NlZ2VGc0dWduUGlpVl9fa1loWHhURGdzbFdvX1RPOGN5djRiMm1lZUI) |
| The Hacker News | GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure | [Source Link](https://news.google.com/rss/articles/CBMigwFBVV95cUxPcUdFVW1kVmNiWlNVOWFhaXpOZlJWbkFSSWlRM1JMNDBRdnRxMjVScEpuUmV6MTZBam5Gek5JVDcwbUtEUThUNTdabkxTWFZva1RPeFdQUmhlU0MxeXhsNV8tSjcyQTRyYTI0VHhhbjVIMjd2aF9PdmhxVzA5a0hlX3pkTQ?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-09-11/gitlab-cvss-10-file-read-flaw-draws-in-the-wild-probes-after-disclosure*