---
title: "A critical Path Traversal / Arbitrary File Read vulnerability, CVE-2026-85706, was identified in… — Turan Security xavfsizlik byulleteni — DecisionGateway"
description: "investigation by Turan Security xavfsizlik byulleteni, recorded recently — verbatim quote and source citation."
canonical_url: "https://dgw.tmarket.io/claims/01a1d0dd-4dab-715f-974a-6c7e79abcbdb"
meta:
  "og:description": "investigation by Turan Security xavfsizlik byulleteni, recorded recently — verbatim quote and source citation."
  "og:image": "https://dgw.tmarket.io/og.jpg"
  "og:image:alt": "White network of connected nodes crossed by a timeline on black"
  "og:image:height": "1024"
  "og:image:width": "1024"
  "og:title": "A critical Path Traversal / Arbitrary File Read vulnerability, CVE-2026-85706, was identified in… — Turan Security xavfsizlik byulleteni — DecisionGateway"
  "twitter:image": "https://dgw.tmarket.io/og.jpg"
---

> Index of every page on this site: [llms.txt](https://dgw.tmarket.io/llms.txt)

investigation

# **A critical Path Traversal / Arbitrary File Read vulnerability, CVE-2026-85706, was identified in GitLab CE/EE systems.**

A investigation by Turan Security xavfsizlik byulleteni. Statements are as reported by the cited publishers — not verified by DecisionGateway.

> *GitLab CE/EE tizimlarida CVE-2026-85706 — kritik Path Traversal, Arbitrary File Read zaifligi aniqlandi.*

turansecurityPublished 2026-09-12 [ Read source](https://t.me/turansecurity/664)

## **Discussion**

## **Related claims**

[**A serious vulnerability rated 9.8 was discovered in WordPress (CVE-2026-63030).**turansecurity · investigation](https://dgw.tmarket.io/claims/01a1d0d9-d36c-7a47-9215-349f7174d622) [**A CVE-2026-111497 vulnerability was identified in Google's Brotli data compression library.**Turan Security Xavfsizlik Byulleteni · investigation](https://dgw.tmarket.io/claims/01a1d0d9-efd7-7fac-964b-17ccd3994fcb) [**Turan Security calls on organizations to urgently inventory and update their GitLab infrastructure.**Turan Security · commitment](https://dgw.tmarket.io/claims/01a1d0dd-4ff6-7513-8310-04e48130bf3a) [**Because authentication checks in the Repository commits API are insufficient, a remote unauthenticated attacker can read arbitrary files on the server, including configurations, tokens, keys and credentials.**Turan Security xavfsizlik byulleteni · allegation](https://dgw.tmarket.io/claims/01a1d0dd-4de3-778f-8b36-f7b85f016406) [**The vulnerability exists in WordPress 6.9.x (up to 6.9.5) and 7.0.x (up to 7.0.2) versions.**turansecurity · statement](https://dgw.tmarket.io/claims/01a1d0d9-d3ea-7563-9319-c2c3bae1c6dd) [**Affected GitLab CE/EE versions are 18.7 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2.**Turan Security xavfsizlik byulleteni · statement](https://dgw.tmarket.io/claims/01a1d0dd-4e85-7aba-97fe-f0ab0ad14888)

[All claims](https://dgw.tmarket.io/claims)

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://dgw.tmarket.io/#website","@type":"WebSite","description":"Decisions, events and falsifiable forecasts from 4,000+ Telegram channels — every claim cited. Read free.","name":"DecisionGateway","url":"https://dgw.tmarket.io/","publisher":{"@id":"https://dgw.tmarket.io/#identity"}},{"@id":"https://dgw.tmarket.io/claims/01a1d0dd-4dab-715f-974a-6c7e79abcbdb#webpage","@type":"WebPage","description":"investigation by Turan Security xavfsizlik byulleteni, recorded recently — verbatim quote and source citation.","name":"A critical Path Traversal / Arbitrary File Read vulnerability, CVE-2026-85706, was identified in… — Turan Security xavfsizlik byulleteni — DecisionGateway","url":"https://dgw.tmarket.io/claims/01a1d0dd-4dab-715f-974a-6c7e79abcbdb","breadcrumb":{"@id":"https://dgw.tmarket.io/claims/01a1d0dd-4dab-715f-974a-6c7e79abcbdb#breadcrumb"},"isPartOf":{"@id":"https://dgw.tmarket.io/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://dgw.tmarket.io/claims/01a1d0dd-4dab-715f-974a-6c7e79abcbdb"]}]},{"@id":"https://dgw.tmarket.io/#identity","@type":"Organization","name":"DecisionGateway","url":"https://dgw.tmarket.io"},{"@id":"https://dgw.tmarket.io/claims/01a1d0dd-4dab-715f-974a-6c7e79abcbdb#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://dgw.tmarket.io","position":1},{"@type":"ListItem","name":"Claims","item":"https://dgw.tmarket.io/claims","position":2},{"@type":"ListItem","name":"A critical Path Traversal / Arbitrary File Read…","position":3}]},{"@id":"https://dgw.tmarket.io/claims/01a1d0dd-4dab-715f-974a-6c7e79abcbdb#/schema/quotation/1","@type":"Quotation","dateCreated":"2026-09-12","isBasedOn":"https://t.me/turansecurity/664","text":"GitLab CE/EE tizimlarida CVE-2026-85706 — kritik Path Traversal, Arbitrary File Read zaifligi aniqlandi.","url":"/claims/01a1d0dd-4dab-715f-974a-6c7e79abcbdb"}]}
```

## Sitemap

See the full [sitemap](https://dgw.tmarket.io/sitemap.md) for all pages.