CVE-2025-5101
Description
An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that under certain conditions could have allowed an authenticated attacker to distribute malicious code that appears harmless in the web interface by taking advantage of ambiguity between branches and tags during repository imports.
Summary dbcve.org
In GitLab CE/EE versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1, an authenticated attacker can exploit ambiguity between branches and tags during repository imports to make malicious code appear harmless in the web interface. The vulnerability allows attackers to import repositories where branch and tag names can be manipulated to obscure the true nature of code, deceiving users who view the repository through the web interface.
Mitigation
Upgrade GitLab to version 18.1.5, 18.2.5, 18.3.1 or later. Until upgrade is possible, restrict repository import functionality to trusted users and carefully review all imported repositories for suspicious branch/tag naming.