PT-2025-50581 · Gitlab · Gitlab Ce/Ee

Yvvdwf · Published 2025-12-10 · Updated 2025-12-11 · CVE-2025-8405

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.1 through 18.4.6 GitLab CE/EE versions 18.5 through 18.5.4 GitLab CE/EE versions 18.6 through 18.6.2

Description An authenticated user could perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays. The issue affects GitLab CE/EE.

Recommendations Update GitLab CE/EE to a version after 18.4.6. Update GitLab CE/EE to a version after 18.5.4. Update GitLab CE/EE to a version after 18.6.2.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2025-15872

BIT-GITLAB-2025-8405

CVE-2025-8405

Affected Products

Gitlab Ce/Ee

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8405.json · Exploit
• 🔥 https://hackerone.com/reports/3270940 · Exploit
• https://cve.org/CVERecord?id=CVE-2025-8405 · Security Note
• https://ubuntu.com/security/CVE-2025-8405 · Vendor Advisory
• https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15872 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8405 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-8405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8405 · Security Note
• https://twitter.com/CveFindCom/status/1998990962069008574 · Twitter Post
• https://t.me/CVEtracker/39442 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/558214 · Note
• https://twitter.com/CVEnew/status/1999108870703394818 · Twitter Post