The hole is in the repository commits API. One unauthenticated POST with a crafted `file.path` walks out of the repo directory and reads arbitrary server files — credentials, secrets, tokens — with no login and no user interaction. A researcher going by 's3ntago' reported it through the company's HackerOne program, and the fix shipped Thursday in Community and Enterprise Edition 19.3.2, 19.2.6, and 19.1.8. GitLab.com is already patched; the exposure is entirely self-hosted. Exploitation started fast. watchTowr logged in-the-wild probes by 06:00 UTC the next morning and expects indiscriminate scanning to follow — one HTTP request, zero auth, nothing to slow an attacker down. CISA added the bug to its Known Exploited Vulnerabilities catalog on Friday and set a September 14 remediation deadline for federal civilian agencies. If you run your own instance, treat that Monday date as yours too: patch, then grep the commits-API logs for POSTs carrying traversal sequences in `file.path`.