Critical GitLab Path Traversal Vulnerability Targeted One Day Post-Disclosure

A critical-severity vulnerability affecting GitLab instances has seen active exploitation in the wild just twenty-four hours following its public disclosure. The flaw stems from an unauthenticated path traversal weakness that enables malicious actors to read arbitrary files from underlying GitLab servers. Given the central role that GitLab instances play in storing proprietary source code, secrets, and deployment keys, this vulnerability poses a severe threat to software supply chain security.

Impact on the Software Supply Chain

Exploitation of this path traversal issue allows unauthenticated remote attackers to bypass access controls and extract critical server-side files, including configuration files, API tokens, cryptographic keys, and database credentials. Threat actors often leverage exposed credentials to pivot deeper into internal enterprise infrastructure or inject malicious code into CI/CD build pipelines. The rapid transition from disclosure to weaponization demonstrates the speed with which adversaries scan the public internet for unpatched instances.

Immediate Actions for Remediation

To safeguard GitLab deployments, FORTSECURE GLOBAL recommends executing the following measures immediately:

• Deploy Emergency Patches: Upgrade self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) instances to the latest security patch releases without delay.
• Audit Access Logs for Indicators of Compromise: Review web server and reverse proxy logs for anomalous HTTP requests containing directory traversal sequences (such as ../ patterns) targeting GitLab endpoints.
• Rotate Potentially Exposed Secrets: In cases where exposure is confirmed or suspected, immediately rotate all CI/CD tokens, database passwords, and SSH keys associated with the affected instance.

---

แหล่งที่มา: SecurityWeek เผยแพร่ครั้งแรก: Fri, 11 Sep 2026 16:11:08 +0000 บทความต้นฉบับ: อ่านต้นฉบับ