MEDIUM

CVE-2026-2995

Gitlab GitLab 2026-03-25 CVSS v3.1

CVSS

5.4

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content.

Summary dbcve.org

This is a HTML injection vulnerability in GitLab EE where authenticated users can inject arbitrary HTML content into email address fields of targeted user accounts due to improper sanitization, potentially allowing script execution via stored XSS.

Mitigation

Upgrade GitLab to version 18.8.7, 18.9.3, 18.10.1 or later. Implement input validation and output encoding for user-supplied email addresses in the interim.

Weakness (CWE)

CWE-80

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.19%

Probability of exploitation in next 30 days

8.6th percentile

References

https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/work_items/591065 Broken Link https://hackerone.com/reports/3564600 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE