CVE-2026-85706

CVE-2026-85706 Unauthenticated path traversal / arbitrary file read in GitLab CE and EE. CVSS 10.0. Verified against a self-managed 19.3.1 instance in a local lab. Affected GitLab CE/EE: 18.7 up to 19.1.7 19.2.0 up to 19.2.5 19.3.0 up to 19.3.1 Precondition: the instance has at least one public...