This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Gitlab CE/EE fixes 12 vulnerabilities - Test
GitLab is releasing versions 18.2.2, 18.1.4 and 18.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE), which fix 12 vulnerabilities. The most serious of them are described below, the rest can be found at [1].
An authenticated remote attacker can carry out an XSS attack using a vulnerability in the blob viewer of GitLab CE/EE [1].
The vulnerability is present in products:
- GitLab Community Edition; >=14.2, <18.0.6, >=18.1, <18.1.4, >=18.2, <18.2.2
- GitLab Enterprise Edition; >=14.2, <18.0.6; >=18.1, <18.1.4; >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-7734 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
Using a vulnerability in "work item names" in GitLab CE/EE, an authenticated remote attacker was able to inject malicious HTML code and take over the victim's account [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.1, <18.1.4, >=18.2, <18.2.2
- GitLab Enterprise Edition; >=18.1, <18.1.4, >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-6186 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
Using a vulnerability in the descriptions of "scoped labels" in GitLab CE/EE, an authenticated remote attacker was able to inject malicious HTML code and carry out an XSS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.2, <18.2.2
- GitLab Enterprise Edition; >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-7739 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
Due to incorrect permission settings in the project API in GitLab CE/EE, an authenticated remote attacker with maintainer privileges can manipulate shared infrastructure resources beyond their access and cause a denial of service for other users' CI/CD pipelines [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.0, <18.0.6, >=18.1, <18.1.4, >=18.2, <18.2.2
- GitLab Enterprise Edition; >=18.0, <18.0.6, >=18.1, <18.1.4, >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2025-8094 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
Due to incorrect privilege assignment in the issue deletion operation in GitLab CE/EE, an authenticated remote attacker may be able to delete confidential issues as well, by inviting users with a certain role [1].
The vulnerability is present in products:
- GitLab Community Edition; >=17.7, <18.0.6; >=18.1, <18.1.4; >=18.2, <18.2.2
- GitLab Enterprise Edition; >=17.7, <18.0.6; >=18.1, <18.1.4; >=18.2, <18.2.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
More information:
- CVE-2024-12303 at cve.org, NVD
- CWE-266: Incorrect Privilege Assignment at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
By CESNET, z.s.p.o. Henrieta Paločková on 6. 11. 2025.