GitLab warns of critical file-read bug and urges immediate server updates
GitLab has disclosed a maximum-severity path traversal vulnerability (CVE-2023-2825) in its repository commits API that could let unauthenticated attackers read arbitrary files on vulnerable servers. The company also patched a second critical flaw (CVE-2026-87719) involving insecure deserialization in the GraphQL subscription serializer, which could expose credentials and instance configurations. Administrators of self-managed GitLab CE and EE installations are strongly advised to upgrade to versions 19.3.2, 19.2.6, or 19.1 immediately.
The path traversal flaw was reported through GitLab's bug bounty program and stems from missing authentication checks in the commits API. A separate critical issue involves insecure deserialization in the GraphQL subscription serializer, specifically impacting Enterprise Edition users with Duo Chat access, potentially exposing credentials and configuration data.
GitLab has already deployed fixes to its cloud platform, while self-managed installations must upgrade to specific releases. This advisory follows a history of similar path traversal issues, including one addressed in 2023, and comes after federal agencies urged developers to eliminate such "unforgivable" flaws.
The immediate impact falls on self-managed GitLab administrators, particularly those in large enterprises, as unauthenticated file reads could expose proprietary source code, credentials, and tokens. If exploited, this could lead to broader network compromise or supply-chain attacks, given GitLab's widespread use among Fortune 100 firms. The separate EE flaw may allow authenticated insiders to escalate privileges. While patches are available, organizations with slow update cycles could remain vulnerable, potentially affecting their customers and partners downstream.