This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] GitLab CE/EE fixes 7 vulnerabilities

GitLab versions 17.10.1, 17.9.3 and 17.8.6 fix 7 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe ones are described below; the remaining vulnerabilities can be found at [1].

GitLab CE/EE - XSS (CVE-2025-2255)
CVSS 8.7 (High)

An authenticated remote attacker can carry out an XSS attack through certain error messages in merge requests [1].

The vulnerability is present in products:

  • *:GitLab Community Edition;>=13.5.0,<17.8.6;>=17.9,<17.9.3;>=17.10,<17.10.1;
  • *:GitLab Enterprise Edition;>=13.5.0,<17.8.6;>=17.9,<17.9.3;>=17.10,<17.10.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

More information:

  • CVE-2025-2255 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 26. 3. 2025.

GitLab CE/EE - XSS (CVE-2025-0811)
CVSS 8.7 (High)

Due to improper rendering of certain file types, an authenticated remote attacker can carry out an XSS attack [1].

The vulnerability is present in products:

  • *:GitLab Community Edition;>=17.7,<17.8.6;>=17.9,<17.9.3;>=17.10,<17.10.1;
  • *:GitLab Enterprise Edition;>=17.7,<17.8.6;>=17.9,<17.9.3;>=17.10,<17.10.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

More information:

  • CVE-2025-0811 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 26. 3. 2025.

GitLab CE/EE - unauthorized access (CVE-2025-2242)
CVSS 7.5 (High)

Due to improper access control, an authenticated remote attacker who was previously an instance administrator and whose role was subsequently revoked can continue to hold the original, elevated permissions to groups and projects [1].

The vulnerability is present in products:

  • *:GitLab Community Edition;>=17.4,<17.8.6;>=17.9,<17.9.3;>=17.10,<17.10.1;
  • *:GitLab Enterprise Edition;>=17.4,<17.8.6;>=17.9,<17.9.3;>=17.10,<17.10.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 26. 3. 2025.

GitLab CE/EE - unauthorized access (CVE-2024-12619)
CVSS 5.2 (Medium)

An authenticated remote attacker with the External User role [2] can gain unauthorized access to internal projects [1].

The vulnerability is present in products:

  • *:GitLab Community Edition;>=16.0,<17.8.6;>=17.9,<17.9.3;>=17.10,<17.10.1;
  • *:GitLab Enterprise Edition;>=16.0,<17.8.6;>=17.9,<17.9.3;>=17.10,<17.10.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

More information:

The vulnerability was publicly disclosed 26. 3. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 27. 3. 2025.

CESNET, z.s.p.o. Logo