This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 5 vulnerabilities
GitLab versions 18.1.1, 18.0.3 and 17.11.5 fix 5 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe of them are described below; the remaining vulnerabilities can be found at [1].
An authenticated remote attacker can, under certain conditions, perform a DoS attack by sending specially crafted GraphQL queries [1].
The vulnerability is present in products:
- GitLab Community Edition; >=10.7, <17.11.5; >=18.0, <18.0.3; >=18.1, <18.1.1;
- GitLab Enterprise Edition; >=10.7, <17.11.5; >=18.0, <18.0.3; >=18.1, <18.1.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-3279 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 26. 6. 2025.
An unauthenticated remote attacker can upload arbitrary files to public projects without authorization by sending specially crafted API requests [1].
The vulnerability is present in products:
- GitLab Community Edition; >=17.2, <17.11.5; >=18.0, <18.0.3; >=18.1, <18.1.1;
- GitLab Enterprise Edition; >=17.2, <17.11.5; >=18.0, <18.0.3; >=18.1, <18.1.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
More information:
- CVE-2025-1754 at cve.org, NVD
- CWE-306: Missing Authentication for Critical Function at cwe.mitre.org
The vulnerability was publicly disclosed 26. 6. 2025.
By CESNET, z.s.p.o. Michaela Ručková on 26. 6. 2025.