CVE-2026-10053 is a High (CVSS 8.5) path traversal in the package registry of GitLab CE and EE. Under certain conditions an authenticated user could achieve remote code execution. Upgrade to 19.0.6, 19.1.4 or 19.2.2, or later, depending on your release line.
What's affected
GitLab says all versions from 18.8 before 19.0.6, from 19.1 before 19.1.4, and from 19.2 before 19.2.2 are affected, in both Community and Enterprise editions. The weakness is CWE-22 (path traversal).
The record describes it in one sentence: under certain conditions, an authenticated user could achieve remote code execution through a path traversal vulnerability in the package registry. The CVSS 3.1 vector is network, high complexity, low privileges, no user interaction, with a changed scope and high impact on confidentiality, integrity and availability.
The record's references are a GitLab work item and a HackerOne report. When we fetched the GitLab work item, the page returned no readable advisory text, so we could not add anything about exploitation conditions beyond the record. Check the GitLab release post and the work item for the full detail.
Fixed versions from the record:
- 19.0 line: 19.0.6.
- 19.1 line: 19.1.4.
- 19.2 line: 19.2.2.
Instances on 18.8 through 18.x or earlier 19.0 builds should move to 19.0.6 or later.
How to check if you're exposed
Find your GitLab version. Signed in users can open the Help page, which shows the version, and administrators can see it on the Admin area overview. On a Linux package install you can also read it on the host.
sudo gitlab-rake gitlab:env:info
Compare the result with the ranges above. If you are on 18.8 or later and below the fixed build for your line, update.
Next, consider whether the package registry is enabled and who can use it. The flaw needs an authenticated user, so the number of accounts that can publish packages matters. Review which users and tokens have write access to package registries, and remove any that are stale.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Check your GitLab version and map it to 19.0.6, 19.1.4 or 19.2.2.
- Upgrade to the fixed version for your line, or to a later release.
- Review who can publish to the package registry, including deploy tokens and personal access tokens.
- Disable the package registry on projects that do not use it, if your policy allows.
- Read the GitLab release post for the patch release to see whether any other fixes apply to you.
Why it matters
Path traversal happens when a program builds a file path from user input and does not stop the path from escaping its intended directory. In a package registry, uploads carry names and paths from the person publishing, so that boundary matters.
Here, GitLab says the result could be remote code execution for an authenticated user. A source code platform holds repositories, CI secrets and deploy keys, so a server side compromise is serious. The record does not mark the CVE as known exploited, and the sources we reviewed report no exploitation.
Quick check
Does this need an account?
Yes. The record says an authenticated user could reach remote code execution under certain conditions.
Which GitLab editions are affected?
GitLab CE and EE, in the version ranges from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.
Sources
Last reviewed: 18 October 2026.
