PT-2025-50585 · Gitlab · Gitlab Ce/Ee

Joaxcar · Published 2025-12-10 · Updated 2025-12-17 · CVE-2025-12734

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.6 through 18.4.6 GitLab CE/EE versions 18.5 through 18.5.4 GitLab CE/EE versions 18.6 through 18.6.2

Description GitLab has addressed an issue that could allow an authenticated user to reveal sensitive information through specially designed merge request titles. The issue affects GitLab CE/EE.

Recommendations GitLab CE/EE versions prior to 18.4.6 should be updated. GitLab CE/EE versions prior to 18.5.4 should be updated. GitLab CE/EE versions prior to 18.6.2 should be updated.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2025-15832

BIT-GITLAB-2025-12734

CVE-2025-12734

Affected Products

Gitlab Ce/Ee

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12734.json · Exploit
• 🔥 https://hackerone.com/reports/3379381 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12734 · Security Note
• https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12734 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-12734 · Security Note
• https://bdu.fstec.ru/vul/2025-15832 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12734 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-12734 · Vendor Advisory
• https://twitter.com/CVEnew/status/1999108866018320511 · Twitter Post
• https://t.me/CVEtracker/39463 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/579573 · Note
• https://t.me/cveNotify/146031 · Telegram Post
• https://t.me/cveNotify/145415 · Telegram Post