GitLab instances are vulnerable to unauthenticated arbitrary file read attacks, which are currently being actively exploited in the wild.

This vulnerability is a path traversal flaw (CWE-22) in the repository commits API, caused by improper path confinement and a total lack of authentication enforcement. An unauthenticated remote attacker can leverage this to access sensitive files on the underlying host.

The ability for an unauthenticated attacker to read arbitrary files from a GitLab server represents a critical risk to the confidentiality and integrity of the entire software development lifecycle. This could lead to the exposure of source code, configuration files, environment secrets, and credentials, effectively enabling further lateral movement and system compromise. Given the CVSS score of 10.0 and confirmed active exploitation, this vulnerability poses an immediate and severe threat to organizational data security.

Immediate Action: Upgrade all affected GitLab installations to versions 19.1.8, 19.2.6, or 19.3.2 immediately.

Proactive Monitoring: Review web server and API access logs for anomalous requests to the repository commits endpoint, specifically looking for path traversal patterns such as dot-dot-slash sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing directory traversal sequences directed at the GitLab API, though this should be considered a temporary stopgap until patching is complete.

Public Exploit Available: Yes, multiple public proofs-of-concept are available on GitHub and the vulnerability is documented via a HackerOne report.

Due to the critical severity of this flaw, the presence of active exploitation, and the availability of public exploit code, organizations must prioritize patching GitLab instances immediately. Delaying the update to the specified fixed versions leaves the environment exposed to unauthorized data exfiltration and potential full system compromise. Ensure that patching cycles are expedited to meet the urgency required by this confirmed, high-impact threat.