PT-2025-26446 · Gitlab · Gitlab Ce/Ee

Published 2025-03-17 · Updated 2025-08-12 · CVE-2025-2443

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.6 through 17.9.6 GitLab EE versions 17.10 through 17.10.4 GitLab EE versions 17.11 through 17.11.0

Description: An issue in GitLab EE allows for cross-site-scripting attacks and content security policy bypass in a user's browser under specific conditions.

Recommendations: For versions 16.6 through 17.9.6, update to version 17.9.7 or later. For versions 17.10 through 17.10.4, update to version 17.10.5 or later. For versions 17.11 through 17.11.0, update to version 17.11.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-07595

BIT-GITLAB-2025-2443

CVE-2025-2443

Affected Products

Gitlab Ce/Ee

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2443.json · Exploit
• 🔥 https://hackerone.com/reports/3037340 · Exploit
• https://osv.dev/vulnerability/BIT-gitlab-2025-2443 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2443 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-2443 · Security Note
• https://bdu.fstec.ru/vul/2025-07595 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2443 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2443 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2443 · Security Note
• https://twitter.com/CveFindCom/status/1936116965178855464 · Twitter Post
• https://t.me/cvetracker/26681 · Telegram Post
• https://t.me/cveNotify/131811 · Telegram Post
• https://twitter.com/CVEnew/status/1936472547517722948 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/525363 · Note
• https://about.gitlab.com/releases/2025/04/23/patch-release-gitlab-17-11-1-released · Note