Overview Recently, NSFOCUS CERT monitored that GitLab released a security update to fix the GitLab Remote Code Execution Vulnerability (CVE-2026-97229). Due to insufficient validation of regular expressions in GitLab's CI/CD configuration, unauthenticated attackers can construct special regular expressions within the CI/CD configuration to trigger an integer overflow during compilation, thereby...
Tag: GitLab
GitLab Authentication Bypass Vulnerability (CVE-2024-6385) Notification
Overview Recently, NSFOCUS CERT detected that GitLab issued a security announcement and fixed the identity bypass vulnerability (CVE-2024-6385) in GitLab Community Edition (CE) and Enterprise Edition (EE). Due to the incomplete fixing of CVE-2024-5655, if the target branch has been deleted, when the target Gitlab repository merges the Merge Request...
GitLab Arbitrary File Write Vulnerability (CVE-2024-0402) Alert
Overview Recently, NSFOCUS CERT detected that GitLab officially released a security announcement and fixed an arbitrary file write vulnerability (CVE-2024-0402) in GitLab Community Edition (CE) and Enterprise Edition (EE). Due to path traversal issues, authenticated attackers can copy files to any location on the GitLab server when creating workspaces. The...
GitLab Unauthorized Call Vulnerability (CVC-2023-5009) Notification
Overview Recently, NSFOCUS CERT monitored that GitLab officially issued a security notice, and fixed an unauthorized call vulnerability in GitLab Enterprise Edition (EE). The vulnerability is a bypass of CVE-2023-3932. An attacker with low privileges can abuse the scan execution policy to run pipelines without the user's consent. Successful exploitation...
GitLab Unauthorized Access Vulnerability (CVS 2023-3484) Notification
Overview Recently, NSFOCUS CERT monitored that GitLab officially issued a security notice, which fixed an unauthorized access vulnerability in Gitlab EE. In some cases, remote attackers with low privileges can change the name or path of a public top-level group beyond their authority. The CVSS score is 8.0. Affected users...
GitLab Arbitrary File Read Vulnerability (CVS 2023-2825)
Overview Recently, NSFOCUS CERT found that GitLab officially issued a security notice, fixing an arbitrary file reading vulnerability (CVE-2023-2825) in GitLab Community Edition (CE) and Enterprise Edition (EE). When there are attachments in public projects nested in at least five groups, unauthenticated remote attackers use the upload function to traverse...
