This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 12 vulnerabilities
GitLab versions 18.2.2, 18.1.4, 18.0.6 fix 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) products. The most severe of them are described below; the remaining vulnerabilities can be found at [1].
An authenticated remote attacker, due to a vulnerability in the blob viewer in GitLab CE/EE, is able to carry out an XSS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=14.2, <18.0.6; >=18.1, <18.1.4; >=18.2, <18.2.2
- GitLab Enterprise Edition; >=14.2, <18.0.6; >=18.1, <18.1.4; >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-7734 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
An authenticated remote attacker, due to a vulnerability in scoped label descriptions in GitLab CE/EE, is able to inject malicious HTML code and carry out an XSS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.2, <18.2.2
- GitLab Enterprise Edition; >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-7739 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
An authenticated remote attacker, due to a vulnerability in work item (Workitem) titles in GitLab CE/EE, is able to inject malicious HTML code and take over the victim's account [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.1, <18.1.4; >=18.2, <18.2.2
- GitLab Enterprise Edition; >=18.1, <18.1.4; >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-6186 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
An authenticated remote attacker with maintainer privileges, due to improper privilege management in the project API in GitLab CE/EE, is able to abuse shared infrastructure resources beyond the scope of their access and thereby cause a denial of service of other users' CI/CD pipelines [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2025-8094 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
An authenticated remote attacker, due to incorrect privilege assignment in the issue deletion operation in GitLab CE/EE, is able to delete even confidential issues by inviting users with a certain role [1].
The vulnerability is present in products:
- GitLab Community Edition; >=17.7, <18.0.6; >=18.1, <18.1.4; >=18.2, <18.2.2
- GitLab Enterprise Edition; >=17.7, <18.0.6; >=18.1, <18.1.4; >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
More information:
- CVE-2024-12303 at cve.org, NVD
- CWE-266: Incorrect Privilege Assignment at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
An authenticated remote attacker, due to improper allocation of resources without limits in release names in GitLab CE/EE, is able to cause a denial of service [1].
The vulnerability is present in products:
- GitLab Community Edition; >=11.6, <18.0.6; >=18.1, <18.1.4; >=18.2, <18.2.2
- GitLab Enterprise Edition; >=11.6, <18.0.6; >=18.1, <18.1.4; >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-2614 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
By CESNET, z.s.p.o. Michaela Jarošová on 19. 8. 2025.