GitLab contains a server‑side request forgery vulnerability caused by a time‑of‑check to time‑of‑use race condition in URL validation during repository import operations. When an authenticated user supplies a specially crafted URL that resolves to an internal IP address, the GitLab import service can fetch that resource, allowing the attacker to reach internal network resources, exfiltrate data, or pivot to other services. The weakness is classified as CWE‑918.

The affected systems are GitLab Community Edition and Enterprise Edition across all releases from version 10.3 up to 19.2.7, from 19.3.1 to 19.3.4, and up to 19.4.1. These versions lack the fix that was deployed in 19.2.8, 19.3.5, and 19.4.2.

The CVSS of 3.5 indicates low technical severity, and no EPSS score is available, suggesting low documented exploitation risk. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is an authenticated internal request, meaning exploitation requires an account with permission to initiate a repository import. If an attacker can pivot from such an account, lateral movement to other internal services could be possible.