This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab fixes 18 vulnerabilities
GitLab versions 19.3.2, 19.2.6 and 19.1.8 fix 18 vulnerabilities, 2 of them critical, in GitLab Community Edition (CE) and GitLab Enterprise Edition (EE) [1]. The most severe vulnerabilities are listed below.
An unauthenticated remote attacker can read arbitrary files from the server due to insufficient path restriction in the repository commits API [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.7, <19.1.8; >=19.2, <19.2.6; >=19.3, <19.3.2
- GitLab Enterprise Edition; >=18.7, <19.1.8; >=19.2, <19.2.6; >=19.3, <19.3.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
More information:
- CVE-2026-85706 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2026.
An authenticated remote attacker with access to Duo Chat can obtain the Advanced Search instance configuration and sensitive credentials due to insecure deserialization in the GraphQL subscriptions serializer [1].
The vulnerability is present in product:
- GitLab Enterprise Edition; >=18.3, <19.1.8; >=19.2, <19.2.6; >=19.3, <19.3.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-87719 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2026.
An authenticated remote attacker can execute arbitrary code by importing a crafted Git project export due to a buffer overflow during Advanced Search indexing [1].
The vulnerability is present in product:
- GitLab Enterprise Edition; >=12.3, <19.1.8; >=19.2, <19.2.6; >=19.3, <19.3.2
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-88765 at cve.org, NVD
- CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2026.
An authenticated remote attacker with the Developer role can obtain protected CI/CD variables intended for higher roles through a test pipeline due to insufficient scope validation [1].
The vulnerability is present in product:
- GitLab Enterprise Edition; >=19.0, <19.1.8; >=19.2, <19.2.6; >=19.3, <19.3.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
More information:
- CVE-2026-79708 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2026.
By CESNET, z.s.p.o. Michaela Jarošová on 11. 9. 2026.