GitLab has issued patches for multiple vulnerabilities, including a maximum-severity path traversal flaw (CVE-2026-85706) in its repository commits API. This vulnerability, with a CVSS score of 10.0, allows unauthenticated users to read arbitrary files from the GitLab server. Probes for exploitation were observed shortly after public disclosure, emphasizing the need for immediate updates.