CVE-2025-6454
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.
Summary dbcve.org
This is a Server-Side Request Forgery (SSRF) vulnerability in GitLab CE/EE where authenticated users can inject crafted sequences into requests, enabling them to make the GitLab server perform unintended internal network requests through configured proxy environments. This could allow access to internal services, metadata endpoints, or infrastructure that should not be exposed.
Mitigation
Upgrade GitLab to version 18.1.6, 18.2.6, or 18.3.2 or later. If immediate patching is not possible, review and restrict proxy configurations and network access controls to limit potential internal reconnaissance.