Skip to content
OpenAdvisories
High NCSC-2025-0390 10 CVEs

Kwetsbaarheden verholpen in GitLab CE/EE

Published Dec 11, 2025 · Updated Dec 11, 2025 · nl

Vendor: GitLab Product: Community Edition, Enterprise Edition Product: GitLab

Summary

GitLab heeft kwetsbaarheden verholpen in GitLab CE/EE.

Details

Interpretaties
De kwetsbaarheden omvatten verschillende problemen, waaronder de mogelijkheid voor geauthenticeerde gebruikers om kwaadaardige afbeeldingen te uploaden, ongeautoriseerde acties uit te voeren door het injecteren van kwaadaardige HTML, gevoelige informatie te verkrijgen via GraphQL-queries, en het omzeilen van WebAuthn tweefactorauthenticatie. Daarnaast kunnen ongeauthenticeerde gebruikers kwaadaardige scripts injecteren in de Swagger UI en GraphQL-querycomplexiteitslimieten misbruiken, wat kan leiden tot Denial of Service (DoS) situaties.

Oplossingen
GitLab heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 10

  • High 8.7
    CVE-2025-12716

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of anot…

    GitLab GitLab Web / CMS
  • High 8.0
    CVE-2025-12029

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf …

    GitLab GitLab Web / CMS
  • High 7.7
    CVE-2025-8405

    Improper Encoding or Escaping of Output in GitLab

    GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecti…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2025-12562

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queri…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.8
    CVE-2025-11984

    Authentication Bypass Using an Alternate Path or Channel in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to bypass WebAuthn two-factor authentication by manipulating the session st…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-14157

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a Denial of Service condition by sending crafted API calls with lar…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-4097

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a denial of service condition by uploading specially crafted imag…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-11247

    Authorization Bypass Through User-Controlled Key in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifica…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2025-13978

    Generation of Error Message Containing Sensitive Information in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to discover the names of private projects they do not have access through A…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.5
    CVE-2025-12734

    Improper Encoding or Escaping of Output in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to, under certain conditions, render content in dialogs to other users by i…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/