Path traversal

GitLab fixes maximum-severity CVSS 10.0 file-read flaw as in-the-wild exploitation begins

GitLab pushed emergency patches for CVE-2026-85706, an unauthenticated CVSS 10.0 path traversal flaw in the repository commits API that allows remote file extraction.