PT-2025-46788 · Unknown · Gitlab Ce/Ee

Published 2025-11-13 · Updated 2026-01-16 · CVE-2025-11224

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 3.1 through 7.7

Description Multiple vulnerabilities exist in GitLab CE and EE, including Cross-Site Scripting (XSS), Information Disclosure, and Prompt Injection. These issues could potentially lead to a compromise of systems. A high-severity XSS flaw (CVE-2025-11224) specifically poses a risk of Kubernetes proxy session hijacking. The number of potentially affected devices worldwide is not specified. The API endpoints and vulnerable parameters are not specified.

Recommendations Update to a newer version of GitLab to address these vulnerabilities. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-GITLAB-2025-11224

CVE-2025-11224

Affected Products

Gitlab Ce/Ee

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11224.json · Exploit
• 🔥 https://hackerone.com/reports/3277291 · Exploit
• https://ubuntu.com/security/CVE-2025-11224 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11224 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11224 · Security Note
• https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11224 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11224 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-11224 · Vendor Advisory
• https://t.me/netlas/507 · Telegram Post
• https://twitter.com/Netlas_io/status/1988858193640820839 · Twitter Post
• https://twitter.com/Komodosec/status/2002212244093088107 · Twitter Post
• https://t.me/pentestingnews/70866 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2011626080340156539 · Twitter Post
• https://twitter.com/fridaysecurity/status/1988793091189522903 · Twitter Post