EUVD-2025-20989CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
4Tags
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.
Analysis
CVE-2025-6948 is a Stored Cross-Site Scripting (XSS) vulnerability in GitLab CE/EE that allows authenticated attackers to execute actions on behalf of other users through malicious content injection. Affected versions include 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2. An attacker with valid credentials can manipulate the UI context (via user interaction) to perform unauthorized actions with high confidentiality and integrity impact across the GitLab instance.
Technical Context
This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), indicating that GitLab fails to properly sanitize or encode user-supplied input before storing and rendering it in web pages. The vulnerability affects GitLab Community Edition and Enterprise Edition across versions 17.11.x, 18.0.x, and 18.1.x. The attack vector is Network (AV:N) with Low Complexity (AC:L), meaning no special network conditions are required and the exploitation method is straightforward. The vulnerability requires Low Privileges (PR:L), confirming that any authenticated GitLab user can inject malicious payloads. The User Interaction (UI:R) requirement means the attack depends on social engineering or tricking legitimate users into interacting with crafted content, which is typical for XSS exploits targeting action execution.
Affected Products
GitLab Community Edition (CE) and Enterprise Edition (EE): versions 17.11.0 through 17.11.5 (inclusive), versions 18.0.0 through 18.0.3 (inclusive), and versions 18.1.0 through 18.1.1 (inclusive). CPE representation: cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* and cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* with version constraints as specified. Organizations running any version within these ranges should immediately assess their deployment status. The vulnerability affects both self-managed and potentially SaaS GitLab instances, though GitLab.com (SaaS) is typically patched automatically by the vendor.
Remediation
Immediate patch deployment: GitLab CE/EE administrators must upgrade to version 17.11.6 or later (17.11.x line), 18.0.4 or later (18.0.x line), or 18.1.2 or later (18.1.x line). Refer to official GitLab security advisories and release notes at https://about.gitlab.com/releases/ for patch availability and deployment procedures. For organizations unable to patch immediately: (1) restrict GitLab access to trusted networks via firewall/VPN if feasible; (2) audit recent activity logs for suspicious content injections or unauthorized actions; (3) educate users about not clicking untrusted links or interacting with suspicious content within GitLab (projects, issues, MRs, comments); (4) implement Content Security Policy (CSP) headers if not already configured to mitigate XSS impact; (5) consider disabling certain GitLab features (e.g., rich text editing) temporarily if the vulnerability is tied to specific input vectors. Monitor vendor advisories closely for additional guidance.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | ignored | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | vulnerable | 17.6.5-19 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today