Critical GitLab File-Read Flaw Sees In-the-Wild Probing Post-Disclosure

GitLab has issued patches addressing a maximum-severity path traversal vulnerability (CVE-2026-85706) with a CVSS score of 10.0. Located in the repository commits API, the flaw allows unauthenticated attackers to read arbitrary files from the underlying server. Active scanning and exploitation attempts were detected within hours of the public disclosure. Administrators should apply the available patches immediately.