GitLab patches multiple account takeover and injection vulnerabilities
Take action: If you are running self-managed GitLab installations, plan a quick patch to versions 18.0.2, 17.11.4, or 17.10.8. There are three near-critical flaws, and GitLab is by it's nature open to multiple users so the risk is not trivial.
Learn More
GitLab has released security updates for multiple high-severity vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE).
Critical and High-Severity Vulnerabilities:
- CVE-2025-4278 (CVSS score 8.7) - HTML injection vulnerability allowing account takeover through malicious code injection in search functionality
- CVE-2025-2254 (CVSS score 8.7) - Cross-site scripting vulnerability in snippet viewer enabling unauthorized user impersonation
- CVE-2025-5121 (CVSS score 8.5) - Missing authorization issue in GitLab Ultimate EE allowing malicious CI/CD job injection
- CVE-2025-0673 (CVSS score 7.5) - Denial of service vulnerability through infinite redirect loops causing memory exhaustion
Medium-Severity Vulnerabilities:
- CVE-2025-1516 (CVSS score 6.5) - Denial of service via unbounded webhook token names
- CVE-2025-1478 (CVSS score 6.5) - Denial of service via unbounded board names
- CVE-2025-5996 (CVSS score 6.5) - Denial of service via uncontrolled HTTP response processing
- CVE-2024-9512 (CVSS score 5.3) - Information disclosure allowing unauthorized repository cloning
- CVE-2025-5195 (CVSS score 4.3) - Information disclosure via authorization bypass affecting compliance frameworks
- CVE-2025-5982 (CVSS score 3.7) - Group IP restriction bypass enabling access to sensitive information
The vulnerabilities affect multiple GitLab versions, with some dating back several years.
- The HTML injection vulnerability (CVE-2025-4278) impacts all GitLab CE/EE versions starting with 18.0 before 18.0.2,
- The cross-site scripting issue (CVE-2025-2254) affects versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2.
- The CI/CD pipeline injection vulnerability (CVE-2025-5121) is limited to GitLab Ultimate EE versions from 17.11 before 17.11.4 and 18.0 before 18.0.2.
The company released versions 18.0.2, 17.11.4, and 17.10.8 for both to address these security flaws, with administrators strongly urged to upgrade immediately to prevent potential exploitation.
GitLab strongly recommends that all self-managed GitLab installations be upgraded. GitLab.com is already running the patched version, while GitLab Dedicated customers do not need to take action.
