PT-2025-29076 · Gitlab · Gitlab Ce/Ee

Published 2025-07-09 · Updated 2025-07-25 · CVE-2025-6948

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.11 through 17.11.5 GitLab CE/EE versions 18.0 through 18.0.3 GitLab CE/EE versions 18.1 through 18.1.1

Description: An issue has been discovered in GitLab CE/EE that, under certain conditions, could allow an attacker to execute actions on behalf of users by injecting malicious content. Approximately 500,000 instances have been identified. The issue involves an authorization bypass due to Cross-Site Scripting (XSS).

Recommendations: Update to GitLab CE/EE version 17.11.6 or later. Update to GitLab CE/EE version 18.0.4 or later. Update to GitLab CE/EE version 18.1.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-09097

BIT-GITLAB-2025-6948

CVE-2025-6948

Affected Products

Gitlab Ce/Ee

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6948.json · Exploit
• 🔥 https://hackerone.com/reports/3227316 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6948 · Security Note
• https://bdu.fstec.ru/vul/2025-09097 · Security Note
• https://ubuntu.com/security/CVE-2025-6948 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6948 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-6948 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6948 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6948 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1943236245104058432 · Twitter Post
• https://twitter.com/dailycve/status/1948821942003171814 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1943246461552009512 · Twitter Post
• https://about.gitlab.com/releases/2025/07/09/patch-release-gitlab-18-1-2-released · Note
• https://twitter.com/cracbot/status/1944713576091881518 · Twitter Post
• https://twitter.com/cracbot/status/1945075915173847460 · Twitter Post