Developer Tools

In GitLab CE/EE versions 14.1 through 18.1.5, 18.2 through 18.2.5 and 18.3 through 18.3.1 a medium severity vulnerability CVE-2025-4225 was detected. This vulnerability allows an unauthenticated attacker to cause a denial-of-service condition by sending specially crafted GraphQL requests. To address this issue, users should upgrade GitLab CE/EE to versions 18.3.1, 18.2.5 or 18.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-4225.

In GitLab CE/EE versions 8.15 through 18.1.5, 18.2 through 18.2.5 and 18.3 through 18.3.1 a medium severity vulnerability CVE-2025-3601 was detected. This vulnerability allows an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses. To address this issue, users should upgrade GitLab CE/EE to versions 18.3.1, 18.2.5 or 18.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-3601.

In GitLab CE/EE versions before 18.1.5, 18.2 before 18.2.5 and 18.3 before 18.3.1 a medium severity vulnerability CVE-2025-2246 was detected. This vulnerability allows unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API. To address this issue, users should upgrade GitLab CE/EE to versions 18.3.1, 18.2.5 or 18.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2246.

In GitLab CE/EE versions 17.7 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 a medium severity vulnerability CVE-2024-12303 was detected. This vulnerability allows authenticated users with specific roles and permissions to delete issues, including confidential ones, by inviting users with a specific role. To address this issue, users should upgrade GitLab CE/EE to versions 18.0.6, 18.1.4, 18.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12303.

In GitLab CE/EE versions 15.6 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 a medium severity vulnerability CVE-2024-10219 was detected. This vulnerability allows authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints. To address this issue, users should upgrade GitLab CE/EE to versions 18.0.6, 18.1.4, 18.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10219.

In @backstage/plugin-scaffolder-backend versions prior to 2.1.1 a medium severity vulnerability CVE-2025-55285 was detected. Duplicate logging of input values in the fetch:template action could expose template secrets (e.g., ${{ secrets.x }}) in logs, leading to unintended disclosure, though there is no impact if such secrets are not passed through to fetch:template. To address this issue, users should upgrade scaffolder-backend plugin to versions 2.1.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55285.

In GitLab CE/EE versions from 15.7 before 17.11.6, 18.0 before 18.0.4 and 18.1 before 18.1.2 a medium severity vulnerability CVE-2025-5819 was detected. This vulnerability allows authenticated users with developer access to obtain ID tokens for protected branches under certain conditions, due to incorrect permission assignment for a critical resource. To address this issue, users should upgrade GitLab CE/EE to versions 18.2.2, 18.1.4 or 18.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5819.

In GitLab CE/EE versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 a medium severity vulnerability CVE-2025-2937 was detected. This vulnerability allows authenticated users to cause a denial of service condition by sending specially crafted markdown payloads to the Wiki feature due to inefficient regular expression complexity. To address this issue, users should upgrade GitLab CE/EE to versions 18.2.2, 18.1.4 or 18.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2937.

In GitLab EE versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4 and 18.2 prior to 18.2.2 a medium severity vulnerability CVE-2025-2498 was detected. This vulnerability allows users, under certain conditions, to view assigned issues from restricted groups by bypassing IP restrictions due to insufficient granularity of access control. To address this issue, users should upgrade GitLab EE to versions 18.2.2, 18.1.4 or 18.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2498.