GitLab Rushes Out Fixes for Two Critical Server Flaws, One Lets Strangers Read Private Files
A path traversal bug and a second critical flaw in GitLab's enterprise product prompted an urgent patch call for self-hosted installations.
Key points
- GitLab issued emergency patches on Thursday for two critical flaws affecting its self-hosted Community and Enterprise editions.
- CVE-2023-2825, a path traversal bug rated maximum severity, lets unauthenticated attackers read arbitrary files from vulnerable servers.
- A second flaw, CVE-2026-87719, lets logged-in users with Duo Chat access steal credentials and search configurations.
- Fixed versions are GitLab 19.3.2, 19.2.6 and 19.1.9; GitLab.com and GitLab Dedicated customers do not need to act.
- GitLab is used by more than 30 million registered users and over 50% of the Fortune 100.
GitLab told customers on Thursday to patch their self-hosted servers immediately against two critical security holes, including one rated the highest possible severity.
The worse of the pair is CVE-2023-2825, a path traversal flaw. Path traversal means an attacker can trick a web application into reaching outside the folders it's supposed to serve and pulling back files it should never share: source code or configuration secrets, for instance. GitLab says an attacker doesn't even need to log in to exploit it, though only "under certain conditions." The bug was found by a researcher using the handle 's3ntago' and reported through GitLab's HackerOne bug bounty programme.
Who is affected?
Self-hosted GitLab customers, meaning companies that run the software on their own servers rather than using GitLab's cloud. GitLab.com is already patched, and GitLab Dedicated customers don't need to do anything.
That still leaves a lot of exposure. GitLab, a rival to Microsoft's GitHub, is a platform where software developers store and manage their code. The company says it has more than 30 million registered users, and more than 50% of the Fortune 100 use it, including Nvidia, Airbus, T-Mobile and Goldman Sachs.
What is the second bug?
CVE-2026-87719 is an insecure deserialization flaw in the GraphQL subscription serializer, a component that handles data coming into the application. Deserialization bugs let attackers smuggle in booby-trapped data that the server then unpacks and acts on. This one only affects GitLab Enterprise Edition, and the attacker has to be logged in with access to Duo Chat, GitLab's AI assistant. Once in, they can lift sensitive credentials and Advanced Search instance configuration data. GitLab pushed that fix on Wednesday, a day before the path traversal patch.
What should administrators do?
Upgrade now. GitLab has released fixed builds for both Community Edition and Enterprise Edition.
| Detail | Value |
|---|---|
| Path traversal CVE | CVE-2023-2825 |
| Second critical CVE | CVE-2026-87719 |
| Fixed versions | 19.3.2, 19.2.6, 19.1 |
| Affected products | GitLab CE and EE (self-managed) |
| Not affected | GitLab.com, GitLab Dedicated |
"These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately," the company said.
Should ordinary users worry?
Not directly. This is a flaw in the software companies use to build their products, not something an end user of a bank's website would be exposed to. The risk is downstream: if a company's GitLab server is broken into, source code or API keys stored there could leak, and those leaks sometimes surface as customer-facing breaches weeks later.
A recurring theme
Path traversal isn't a new class of bug. CISA and the FBI have called such flaws "unforgivable" in a joint advisory, urging vendors to catch them before shipping. We reported in August on a separate GitLab flaw that let unauthenticated attackers wipe public projects, so this is the fifth GitLab vulnerability Threat Vectr has covered since June.
GitLab has been active on patches this year. In January the company fixed a high-severity two-factor authentication bypass in both editions. CISA has flagged four GitLab bugs as actively exploited since November 2021, two of them, CVE-2021-22175 and CVE-2021-39935, as recently as February.
