CVE-2026-85706 is a path traversal vulnerability in GitLab Community Edition and Enterprise Edition, and it carries a 10.0 CVSS score, the ceiling of the scale. Path traversal means an unauthenticated request can walk out of the web root and read arbitrary files on the server, source code, CI/CD secrets, SSH keys, whatever the GitLab process can see. CISA issued its own alert alongside the disclosure. HKCERT's bulletin the same week bundles it with separate GitLab flaws enabling remote code execution and cross-site scripting, which means a GitLab instance exposed to the internet this week is not choosing between one bad outcome and another.

The mechanism that makes this urgent is not the CVSS number, it is what a self-hosted GitLab instance actually stores. A bank's GitLab holds its CI/CD pipeline credentials, its deployment keys, and often hardcoded API tokens in commit history that nobody scrubbed. File theft off that server does not require a second stage. Separately, The Hacker News reported a suspected Chinese threat actor tracked as Red Heron compromising thirteen organizations across six countries by exploiting a Gitea remote code execution bug, not the same product, not the same vendor, but the same category of target: internet-facing code repository infrastructure that most security teams treat as internal tooling rather than a perimeter asset.

GitLab and Gitea are the two named platforms this week, and the distinction that matters is patch status, not brand. GitLab's flaw is disclosed with no confirmed exploitation yet reported. Red Heron's Gitea exploitation is already active across six countries. An APAC bank running self-hosted GitLab should treat its instance as internet-facing infrastructure holding deployment secrets, not as an internal dev tool, and patch on that basis rather than waiting for its own exploitation report to arrive first.