GitLab RCE via package registry path traversal (CVE-2026-10053) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-10053 is a high-severity remote code execution in GitLab CE/EE versions 18.8 through 19.2 that lets authenticated users achieve RCE via a path traversal flaw in the package registry. Patched in 19.0.6, 19.1.4, and 19.2.2 - upgrade immediately.

Overview

GitLab has remediated a path traversal vulnerability in the package registry affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw exists in all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.

The vulnerability allows an authenticated user to exploit path traversal in the package registry to write files outside the intended directory structure. Under certain conditions, this file write primitive can be chained into remote code execution on the underlying GitLab server. The issue is rated HIGH with a CVSS score of 8.5.

The CVSS vector highlights a network-based attack vector with low privileges required and no user interaction needed. However, the attack complexity is rated HIGH, meaning successful exploitation requires specific conditions to be met. The EPSS model predicts only a 0.7% probability of exploitation within the next 30 days, indicating that while the attack is feasible, it is not currently trivial to execute at scale.

Impact

An authenticated attacker who successfully exploits this vulnerability can:

• Achieve remote code execution on the GitLab server
• Potentially access or modify sensitive data stored on the server
• Compromise the integrity and confidentiality of the GitLab instance
• Use the compromised server as a foothold for lateral movement within the network

Since GitLab instances often store source code, CI/CD pipelines, and credentials, a successful compromise could have cascading effects across an organization’s development infrastructure.

Remediation

GitLab has addressed this issue in the following versions:

• 19.0.6
• 19.1.4
• 19.2.2

All organizations running affected versions should upgrade to one of the patched releases as soon as possible. If upgrading is not immediately possible, restrict access to the package registry functionality and audit logs for unusual file operations or unexpected code execution.

For instance-specific guidance, review the official GitLab advisory and security release notes.

Security Insight

This vulnerability highlights a recurring pattern in software supply-chain tools: features designed to simplify packaging and deployment introduce complex file-handling logic that becomes a prime target for path traversal attacks. GitLab’s package registry joins a growing list of artifact management systems that have faced similar issues, underscoring the need for rigorous input validation in file-storage subsystems. The high complexity score and low EPSS probability suggest that while this is a real risk, it favors targeted attacks over mass exploitation. For related coverage on supply-chain security incidents, see our breach reports and security news.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs