GitLab Max-Severity Path Traversal: One HTTP Request Reads Anything on Your CI Server
A maximum-severity flaw in GitLab’s commits API lets anyone read arbitrary files off your CI server, and scanners were already probing for it within a day of disclosure GitLab shipped patches on Thursday for CVE-2026-85706, a path traversal bug in the repository commits API rated at the maximum severity score. No login required. No token….