CWE-35 or CWE-22? The Classification Split Around CVE-2026-85706
Vulnerability overview
The public records for CVE-2026-85706 do not agree on its weakness classification. NVD carries CWE-22, improper limitation of a pathname to a restricted directory, attributed to cve@gitlab.com as the assigning source. The CISA Known Exploited Vulnerabilities entry lists CWE-35, path traversal with the trailing-dot variants. GitLab's own description uses neither code and says plainly that the issue is a path traversal in the repository commits API.
That divergence is small in wording and meaningful in practice, because classification drives which detection rules and scanner checks an organisation deploys.
Mechanism and exploitation conditions
The two codes describe adjacent things. CWE-22 is the parent concept: a program accepts a path and fails to confine it to the intended directory. CWE-35 is narrower and names a specific evasion family, in which sequences such as .../...// survive naive sanitisation and resolve into a traversal. The vulnerable behaviour GitLab describes, improper path confinement combined with missing authentication enforcement, satisfies CWE-22 directly. A CWE-35 label asserts something additional and more specific about how the path is crafted, and the vendor advisory does not publish the request that would confirm that detail.
The practical reading is that the two records are not contradicting each other. One describes the class of defect, the other describes a technique associated with it, and the CVE.org-sourced NVD text is the one that keeps to the general class.
Impact
For a defender, the split changes which artefacts to build. A rule written for CWE-22 watches for encoded traversal sequences arriving at file-serving parameters. A rule written for CWE-35 watches specifically for the dot-heavy variants that defeat a single-pass sanitiser. GitLab's own detections, which name a metadata.path parameter and generic file-path patterns, cover the wider class while the parameter-level rule catches the narrower technique. Deploying only one of the two leaves a gap on the other side of the split.
Affected products and versions
The classification applies across all affected ranges: 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6 and 19.3 before 19.3.2, in Community Edition and Enterprise Edition. Patching is identical for either code.
Exposure context
ZoomEye returned 1,317,044 matching assets for app="GitLab" on 25 September 2026, and the registry-scoped query vul.cve="CVE-2026-85706" returned zero. The same pattern of one record describing the product and another describing the identifier runs through this case: the useful artefact is a version check, whichever weakness code the tracker displays.
ZoomEye Search Link: https://www.zoomeye.ai/searchResult?q=YXBwPSJHaXRMYWIi
Remediation and mitigations
Upgrade to the branch-appropriate patched release, and where a classification field feeds a control choice, record both codes with their sources rather than overwriting one with the other. Building detection around the union of CWE-22 and CWE-35 coverage is defensible here, since the vendor describes a general path traversal and the catalog entry points at a specific technique within it. Reviewing the three published detections is the shortest path to that union without writing new rules from scratch.
Top comments (0)