investigation
A critical Path Traversal / Arbitrary File Read vulnerability, CVE-2026-85706, was identified in GitLab CE/EE systems.
A investigation by Turan Security xavfsizlik byulleteni. Statements are as reported by the cited publishers — not verified by DecisionGateway.
GitLab CE/EE tizimlarida CVE-2026-85706 — kritik Path Traversal, Arbitrary File Read zaifligi aniqlandi.
Discussion
Related claims
A serious vulnerability rated 9.8 was discovered in WordPress (CVE-2026-63030).turansecurity · investigationA CVE-2026-111497 vulnerability was identified in Google's Brotli data compression library.Turan Security Xavfsizlik Byulleteni · investigationTuran Security calls on organizations to urgently inventory and update their GitLab infrastructure.Turan Security · commitmentBecause authentication checks in the Repository commits API are insufficient, a remote unauthenticated attacker can read arbitrary files on the server, including configurations, tokens, keys and credentials.Turan Security xavfsizlik byulleteni · allegationThe vulnerability exists in WordPress 6.9.x (up to 6.9.5) and 7.0.x (up to 7.0.2) versions.turansecurity · statementAffected GitLab CE/EE versions are 18.7 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2.Turan Security xavfsizlik byulleteni · statement