This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 6 vulnerabilities
GitLab versions 18.2.1, 18.1.3 and 18.0.5 fix 6 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe of them are described below; the remaining vulnerabilities can be found at [1].
An authenticated remote attacker is, under certain conditions, due to a vulnerability in the Kubernetes proxy feature in GitLab CE/EE, allowed to carry out an XSS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=15.10, <18.0.5; >=18.1, <18.1.3; >=18.2, <18.2.1;
- GitLab Enterprise Edition; >=15.10, <18.0.5; >=18.1, <18.1.3; >=18.2, <18.2.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-4700 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2025.
An authenticated remote attacker is, on GitLab CE/EE instances deployed behind certain CDNs (Content Delivery Networks), allowed to carry out an XSS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=15.10, <18.0.5; >=18.1, <18.1.3; >=18.2, <18.2.1;
- GitLab Enterprise Edition; >=15.10, <18.0.5; >=18.1, <18.1.3; >=18.2, <18.2.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-4439 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2025.
An authenticated remote attacker is, under certain circumstances, allowed in GitLab EE to gain unauthorized access to internal notes in GitLab Duo responses [1].
The vulnerability is present in product:
- GitLab Enterprise Edition; >=17.0, <18.0.5; >=18.1, <18.1.3; >=18.2, <18.2.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-4976 at cve.org, NVD
- CWE-213: Exposure of Sensitive Information Due to Incompatible Policies at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2025.
An authenticated remote attacker is, through the GitLab CE/EE API, allowed to gain unauthorized access to certain information about a 'resource_group' [1].
The vulnerability is present in products:
- GitLab Community Edition; >=15.0, <18.0.5; >=18.1, <18.1.3; >=18.2, <18.2.1;
- GitLab Enterprise Edition; >=15.0, <18.0.5; >=18.1, <18.1.3; >=18.2, <18.2.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-7001 at cve.org, NVD
- CWE-1220: Insufficient Granularity of Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2025.
By CESNET, z.s.p.o. Michaela Ručková on 24. 7. 2025.