Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-5101

Good to know:

icon
icon

Date: August 27, 2025

An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that under certain conditions could have allowed an authenticated attacker to distribute malicious code that appears harmless in the web interface by taking advantage of ambiguity between branches and tags during repository imports.

Severity Score

Related Resources (4)

https://hackerone.com/reports/3124199
https://nvd.nist.gov/vuln/detail/CVE-2025-5101
https://gitlab.com/gitlab-org/gitlab/-/issues/545165
https://www.mend.io/vulnerability-database/CVE-2025-5101

Severity Score

Weakness Type (CWE)

Improper Control of Generation of Code ('Code Injection')

CWE-94

Top Fix

icon

Upgrade Version

Upgrade to version https://gitlab.com/gitlab-org/gitlab.git - v18.1.5-ee;https://gitlab.com/gitlab-org/gitlab.git - v18.2.5-ee;https://gitlab.com/gitlab-org/gitlab.git - v18.3.1-ee

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): HIGH
Privileges Required (PR): HIGH
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us