PT-2025-47048 · Gitlab · Gitlab Ce/Ee

Published 2025-11-12 · Updated 2025-11-15 · CVE-2025-11990

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.4 through 18.4.3 GitLab EE versions 18.5 through 18.5.1

Description An authenticated user could obtain CSRF tokens due to improper input validation in repository references and redirect handling weaknesses. The issue involves the exploitation of repository references.

Recommendations Update GitLab EE to version 18.4.4 or later. Update GitLab EE to version 18.5.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-177

Related Identifiers

BDU:2025-14459

BIT-GITLAB-2025-11990

CVE-2025-11990

Affected Products

Gitlab Ce/Ee

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11990.json · Exploit
• 🔥 https://hackerone.com/reports/3257843 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11990 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11990 · Vendor Advisory
• https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14459 · Security Note
• https://t.me/CVEtracker/37416 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/577850 · Note
• https://twitter.com/CVEnew/status/1989608991677358213 · Twitter Post
• https://t.me/cveNotify/142912 · Telegram Post