MEDIUM

CVE-2025-0314

Gitlab GitLab 2025-01-24 CVSS v3.1

CVSS

6.1

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.

Summary dbcve.org

GitLab CE/EE versions 17.2 through 17.6.3, 17.7.0-17.7.2, and 17.8.0 contain a cross-site scripting vulnerability caused by improper rendering of certain file types. An attacker could inject malicious scripts through crafted file uploads that are rendered without proper sanitization.

Mitigation

Upgrade GitLab to version 17.6.4, 17.7.3, or 17.8.1 or later to patch the XSS vulnerability in file type rendering.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.38%

Probability of exploitation in next 30 days

31.7th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/issues/512118 Broken Link https://hackerone.com/reports/2922313 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE