Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-12T03:16:30.473Z",
  "pubdate": "2026-09-12T03:16:30.473Z",
  "executiveSummary": "A critical security vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. This flaw enables unauthenticated remote attackers to read arbitrary files from the underlying hosting server. The vulnerability arises due to a combination of improper path confinement and missing authentication enforcement within the repository commits API.\nBecause the affected endpoint fails to validate user privileges and restrict directory traversal sequences, an attacker can bypass standard access controls. This exposure poses severe risk implications for affected organizations, as it allows unauthorized access to sensitive configuration files, application source code, and cryptographic secrets without requiring any active credentials. Exploitation of this vulnerability requires network access to the GitLab API but demands no user interaction.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper validation of file path inputs coupled with the absence of access control checks within the repository commits API. Typically, API endpoints handling repository files must restrict file system operations to the designated repository directory. However, due to improper path confinement, the application fails to neutralize directory traversal sequences supplied within the API parameters.\nThe attack flow begins with an unauthenticated HTTP request directed at the vulnerable repository commits API endpoint. Because authentication enforcement is missing, the application processes the incoming request without verifying the requester's identity or authorization level. An attacker can construct a payload containing relative directory traversal sequences, such as dot-dot-slash sequences, within the path parameter of the API call.\nWhen the server processes this request, the path-resolution logic resolves the traversal sequences relative to the repository root, effectively escaping the intended directory boundaries. The application then reads the file from the local file system using the privileges of the GitLab system user (typically the 'git' user) and returns the file contents within the HTTP response body.\nThis behavior allows unauthenticated external entities to extract critical system files, including GitLab configuration files containing database credentials, secrets, and environment variables. Access to these secrets can facilitate subsequent administrative privilege escalation or database compromise, resulting in a complete breach of confidentiality and integrity for the hosted repositories and the underlying server infrastructure."
}