Technical impact
GitLab introduced a flaw that allowed an authenticated user to trigger repository downloads containing code that does not match what appears in the web interface, due to incorrect validation of branch references. The vulnerability stems from improper reference resolution, classified under CWE‑706 (Invalid Parameters). The consequence is a potential exposure of unauthorised code and a breach of code integrity, enabling an attacker to deliver unintended changes or malicious snippets to downstream consumers.
Affected Systems
Affected products include GitLab Community Edition (CE) and Enterprise Edition (EE). All versions from 1.0 up to but excluding 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 are vulnerable. The security advisory lists the affected CPEs as gitlab:gitlab for both community and enterprise editions.
Risk and Exploitability
The vulnerability has a CVSS score of 4.1, indicating low to moderate severity, and an EPSS score below 1%, implying a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires authentication to the targeted GitLab instance; an attacker with valid credentials can provoke the download mismatch by using the incorrect branch reference. Once triggered, the attacker can obtain code that differs from what the user sees, potentially facilitating covert data exfiltration or delivery of tainted code.
