← Back

CVE-2025-12506

nvd nist
Published: Jul 8, 2026Modified: Sep 29, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from the content available for download, due to improper handling of Git reference name resolution.

Affected (6)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
16.5.0 ≤ version < 18.11.7
Gitlab
19.0.0 ≤ version < 19.0.4
Gitlab
19.1.0 ≤ version < 19.1.2
Gitlab
16.5.0 ≤ version < 18.11.7
Gitlab
19.0.0 ≤ version < 19.0.4
Gitlab
19.1.0 ≤ version < 19.1.2

Related CWEs

CWE-706
Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

References (3)

Source: cve@gitlab.com
Vendor Advisory
Source: cve@gitlab.com
Broken Link
Source: cve@gitlab.com
Permissions Required

Timeline

No history available yet.