GitLab patches multiple vulnerabilities in self-managed Community and Enterprise editions

GitLab released patch versions 18.6.2, 18.5.4, and 18.4.6 for GitLab Community Edition and Enterprise Edition to fix multiple security flaws affecting self-managed deployments. The company said GitLab.com was already patched and GitLab Dedicated customers did not need to take action, while administrators running affected self-managed versions were urged to upgrade immediately. The fixes were tied to several CVE records, including CVE-2025-12029, CVE-2025-12716, CVE-2025-8405, and CVE-2025-11984.

The patched issues included several high-severity vulnerabilities, such as cross-site scripting in Wiki and Swagger UI, improper encoding in vulnerability reports, and a denial-of-service condition in GraphQL endpoints. GitLab also addressed medium- and low-severity flaws involving WebAuthn, ExifTool processing, the Commit API, compliance frameworks, error messages, and merge request titles. The release included database migrations that could cause downtime on single-node deployments, although multi-node environments could use GitLab's zero-downtime upgrade procedures.