GitLab's Critical Patch Closes a Path Traversal Flaw Attackers Are Already Probing

GitLab released critical patches fixing a maximum severity vulnerability that allows unauthenticated attackers to read arbitrary files on self-managed servers, amid active exploitation attempts; a second critical flaw enables authenticated users to steal sensitive credentials. The key risk lies in the slow patch cycles for self-managed instances that lag behind rapid attacker probing.

This Wire brief sits within Fusion42's coverage of Developer Tools, Cybersecurity and Enterprise Software, and 2 sources have reported it between 12 Sep 2026 and 14 Sep 2026.