Loading story…
GitLab released version 16.0.1 for Community Edition and Enterprise Edition to fix CVE-2023-2825, a critical unauthenticated path traversal vulnerability affecting GitLab 16.0.0. The flaw can allow arbitrary file reads from the server when an attachment exists in a public project nested within at least five groups, creating a path for remote attackers to access sensitive files without logging in.
GitLab assigned the issue a CVSS 3.1 score of 10.0 and urged customers to upgrade immediately. The company said GitLab.com was already running the patched version when the advisory was published, and credited the report to pwnie through GitLab’s HackerOne bug bounty program.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
GitLab released version 16.0.1 for Community Edition and Enterprise Edition on May 23, 2023, to remediate CVE-2023-2825, a critical unauthenticated path traversal vulnerability affecting GitLab 16.0.0. GitLab said GitLab.com was already running the patched version and urged affected self-managed installations to upgrade immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released versions **19.3.2**, **19.2.6**, and **19.1.8** for Community Edition and Enterprise Edition, remediating 18 vulnerabilities. The most severe, **CVE-2026-85706** (CVSS 10.0), is an unauthenticated path-traversal flaw in the repository commits API that enables arbitrary file reads from vulnerable GitLab servers. GitLab also addressed authorization issues, cross-site scripting, CI/CD-variable exposure, and denial-of-service vulnerabilities. Enterprise Edition fixes include **CVE-2026-87719** (CVSS 9.9), an authenticated insecure-deserialization issue associated with Duo Chat/GraphQL subscription handling that can expose Advanced Search configuration and credentials, and **CVE-2026-88765** (CVSS 8.5), which can allow authenticated remote code execution through importing a crafted malicious Git project export. GitLab.com already runs the patched release and GitLab Dedicated customers need take no action; self-managed administrators should upgrade immediately and plan for database migrations, which require downtime on single-node deployments.
Sep 18, 2026
GitLab released security updates for Community Edition and Enterprise Edition in versions **16.6.1**, **16.5.3**, and **16.4.3**, urging affected self-managed installations to upgrade immediately. The fixes addressed multiple vulnerabilities spanning **XSS, privilege escalation, information disclosure, authorization bypass, package registry access issues, protected branch and pipeline schedule permission bypasses, and client-side denial of service**. The most severe issue was **`CVE-2023-6033`**, a high-severity cross-site scripting flaw in Jira integration configuration, while GitLab said **GitLab.com** was already running the patched version. One of the patched Enterprise Edition issues, **`CVE-2023-4658`**, was an incorrect authorization flaw that allowed a guest user to abuse the **"Allowed to merge"** permission when that right was inherited through a group. GitLab rated that bug **CVSS 3.1 / Low** and said it affected versions from **8.13 before 16.4.3**, **16.5 before 16.5.3**, and **16.6 before 16.6.1**. The release also included fixes for unauthorized access to release descriptions and other EE-specific authorization weaknesses, along with bundled component updates for **Mattermost**, **PostgreSQL**, and **pcre2**.
Jul 24, 2026
GitLab released patched Community Edition and Enterprise Edition versions `19.2.2`, `19.1.4`, and `19.0.6` to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade. The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as **CVE-2026-15216** and **CVE-2026-15217**, each with a CVSS score of `8.7`, affecting GitLab CE/EE versions from `18.2` before `19.0.6`, `19.1` before `19.1.4`, and `19.2` before `19.2.2`. GitLab also fixed **CVE-2026-19228**, an authorization bypass issue in GitLab EE with a CVSS score of `8.5`, affecting `19.1` before `19.1.4` and `19.2` before `19.2.2`, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.
Aug 31, 2026