Loading vulnerability…
Git reference name resolution ambiguity in GitLab CE/EE
CVE-2025-12506 is a low-severity vulnerability in GitLab Community Edition and Enterprise Edition caused by improper handling of Git reference name resolution. In affected versions, an authenticated user could, under certain conditions, create a repository in which the content rendered in the GitLab web interface differed from the content obtained through download mechanisms. The issue affects all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2. The flaw stems from ambiguity in resolving tag or branch references, creating a mismatch between how repository content is interpreted and presented across different access paths.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause integrity and trust issues by making repository content appear different in the web interface than in downloadable form. This could mislead users reviewing source code, tags, or branches through the GitLab UI, potentially causing incorrect security, development, or operational decisions based on content that does not match the actual downloadable repository state. Available information does not indicate direct code execution or privilege escalation from this issue.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting repository creation and related write capabilities to trusted authenticated users, increasing review of newly created repositories and suspicious branch or tag naming patterns, and favoring verification of repository state through trusted Git operations rather than relying solely on web-rendered content. These measures are only temporary and do not fully remediate the underlying flaw.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed version. Patched releases are 18.11.7, 19.0.4, and 19.1.2 or later, depending on the deployment track. Self-managed instances on affected versions should be updated promptly.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.