Description
mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted job_id values like ../../../user to escape the intended path prefix and access arbitrary GitLab API resources using the operator's personal access token.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zereight | mcp-gitlab | < 2.1.18 | 2.1.18 |
References
- GitHub Issue issue-tracking
- Product product
- Patch Commit patch
- https://www.vulncheck.com/advisories/mcp-gitlab-path-traversal-via-job-id-parameter third-party-advisory