This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 10 vulnerabilities
GitLab fixes 10 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 18.6.2, 18.5.4 and 18.4.6 [1]. The most severe vulnerabilities are listed below.
An authenticated remote attacker can carry out an XSS attack when creating wiki pages [1].
The vulnerability is present in product:
- GitLab; >=18.4, <18.4.6; >=18.5, <18.5.4; >=18.6, <18.6.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-12716 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 10. 12. 2025.
Under certain circumstances, an unauthenticated remote attacker can carry out an XSS attack in the Swagger UI environment [1].
The vulnerability is present in product:
- GitLab; >=15.11, <18.4.6; >=18.5, <18.5.4; >=18.6, <18.6.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-12029 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 10. 12. 2025.
An unauthenticated remote attacker can carry out a DoS attack by sending an overly complex GraphQL request [1].
The vulnerability is present in product:
- GitLab; >=11.10, <18.4.6; >=18.5, <18.5.4; >=18.6, <18.6.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-12562 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 10. 12. 2025.
By CESNET, z.s.p.o. Martin Krajči on 11. 12. 2025.