CVE-2026-85706 in GitLab: NVD and CISA split on vulnerability classification

Public records for CVE-2026-85706 in GitLab disagree on its weakness class: NVD lists CWE-22, while the CISA KEV catalog lists CWE-35. The flaw is a path traversal in the repository commits API combined with missing authentication enforcement.

• NVD assigns CWE-22 to CVE-2026-85706, CISA KEV assigns CWE-35
• GitLab describes it as a path traversal in the repository commits API
• Affected: 18.7–18.11.12, 19.0–19.0.9, 19.1–19.1.8, 19.2–19.2.6, 19.3–19.3.2
• ZoomEye matched 1,317,044 GitLab assets on 25 September 2026