CVE-2020-10086: 
GitLab vulnerability analysis and mitigation

GitLab versions 10.4 through 12.8.1 were affected by a directory traversal vulnerability (CVE-2020-10086) that allowed arbitrary file read through a particular endpoint. The vulnerability was discovered by @nyangawa of Chaitin Tech and was patched in GitLab versions 12.8.2, 12.7.7, and 12.6.8 released on March 4, 2020 (GitLab Advisory).

The vulnerability was classified as a path traversal vulnerability (CWE-22) with a CVSS v3.1 Base Score of 5.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The issue allowed attackers to traverse directories through a specific endpoint, potentially leading to unauthorized file read access (NVD).

The vulnerability could allow attackers to read arbitrary files on the system through directory traversal, potentially exposing sensitive information. The attack requires no authentication and can be executed remotely (GitLab Advisory).

GitLab strongly recommended that all affected installations be upgraded to the latest version (12.8.2, 12.7.7, or 12.6.8) as soon as possible. The vulnerability was patched in these versions, released on March 4, 2020 (GitLab Advisory).