product1 publisher
GitLab's commits API returns server files to callers who never log in
GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.
Publishers:devops.com
Reality
- Evidence58
- Adoption35
- Hype gap+12
- Incentives45
- Confidence57