Technical impact
The vulnerability is a path traversal flaw in GitLab’s package registry that allows an authenticated user to access files outside the intended directory. This can lead to remote code execution by allowing a malicious repository to contain a crafted file that the server will interpret as executable code. The flaw is categorized as CWE-22 and was present in all GitLab CE/EE releases from 18.8 up to, but not including, 19.0.6, 19.1.4, and 19.2.2.
Affected Systems
GitLab Community Edition and Enterprise Edition users who have installed versions 18.8 or 18.9 and any 19.0, 19.1, or 19.2 releases that are earlier than 19.0.6, 19.1.4, and 19.2.2 respectively. These versions are vulnerable if the package registry feature is enabled and require correction.
Risk and Exploitability
The CVSS base score is 8.5, indicating a high severity. EPSS data is not available, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in CISA’s KEV catalog. Attackers need authenticated access to the GitLab instance and the ability to create or modify packages in the registry. Once the path traversal is exploited, they can achieve remote code execution on the host that runs GitLab.
