PT-2026-24702 · Gitlab+2 · Gitlab

Shells3C · Publicado 2026-03-11 · Atualizado 2026-03-15 · CVE-2026-3848

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.11 through 18.7.5 GitLab CE/EE versions 18.8 through 18.8.5 GitLab CE/EE versions 18.9 through 18.9.1

Description An issue in GitLab CE/EE could allow an authenticated user to make unintended internal requests through proxy environments. This is due to improper input validation within the import functionality.

Recommendations GitLab versions prior to 18.7.6 should be updated. GitLab versions prior to 18.8.6 should be updated. GitLab versions prior to 18.9.2 should be updated.

Correção

Enumeração de Fraquezas

CWE-93

Identificadores relacionados

BIT-GITLAB-2026-3848

CVE-2026-3848

Produtos afetados

Gitlab

Referências · 9

• https://ubuntu.com/security/CVE-2026-3848 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3848 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-gitlab-2026-3848 · Aviso do Fabricante
• https://gitlab.com/gitlab-org/gitlab/-/work_items/577298 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3848 · Aviso do Fabricante
• https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released · Nota
• https://twitter.com/infoflowcloud/status/2032999228016885816 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032998328724521117 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-3848 · Nota de Segurança