PT-2023-2849 · Gitlab · Gitlab

Pwnie · Published 2023-04-12 · Updated 2025-08-17 · CVE-2023-2825

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 16.0.0

Description The issue is related to a path traversal vulnerability that allows an unauthenticated malicious user to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups. This vulnerability can be exploited by a remote attacker to gain unauthorized access to protected information. The vulnerability is caused by incorrect restriction of the path name to a directory with limited access.

Recommendations For GitLab version 16.0.0, update to version 16.0.1 to resolve the issue. As a temporary workaround, consider restricting access to public projects with attachments nested within at least five groups until the update is applied. Avoid using attachments in public projects until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-02794

BIT-GITLAB-2023-2825

CVE-2023-2825

Affected Products

Gitlab

References · 37

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2825.json · Exploit
• 🔥 https://github.com/Occamsec/CVE-2023-2825 · Exploit
• 🔥 https://github.com/Groppoxx/CVE-2023-2825-PoC · Exploit
• https://ubuntu.com/security/CVE-2023-2825 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-2825 · Security Note
• https://bdu.fstec.ru/vul/2023-02794 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2023-2825 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2825 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2825 · Vendor Advisory
• https://hackerone.com/reports/1994725 · Note
• https://t.me/ckure/12448 · Telegram Post
• https://t.me/purple_medved/26 · Telegram Post
• https://t.me/apt_notes/908 · Telegram Post