MEDIUM
CVE-2025-7734
CVSS
5.4
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.
Summary dbcve.org
GitLab CE/EE contains an injection vulnerability in versions 14.2 through 18.0.5, 18.1.0-18.1.3, and 18.2.0-18.2.1 that allows attackers to inject malicious content and execute actions on behalf of authenticated users under certain conditions.
Mitigation
Upgrade GitLab to version 18.0.6, 18.1.4, or 18.2.2 or later to patch the vulnerability.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
0.31%
Probability of exploitation in next 30 days
23.7th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.