MEDIUM

CVE-2026-3848

Gitlab GitLab 2026-03-11 CVSS v3.1

CVSS

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to make unintended internal requests through proxy environments under certain conditions due to improper input validation in import functionality.

Summary dbcve.org

This is a Server-Side Request Forgery (SSRF) vulnerability in GitLab's import functionality where improper input validation allows authenticated users to make unintended internal requests through proxy environments. The flaw enables attackers to potentially access internal services or bypass network restrictions.

Mitigation

Upgrade GitLab to version 18.7.6, 18.8.6, or 18.9.2 or later to remediate this vulnerability.

Weakness (CWE)

CWE-93

EPSS Score

0.19%

Probability of exploitation in next 30 days

8.6th percentile

References

https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/work_items/577298 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE