The vulnerability is a resource injection flaw in GitLab's Terraform state upload functionality. It arises from improper validation of parameters that can be supplied in uploaded state files. This flaw could allow an authenticated user with project-level permissions to read restricted file contents on the GitLab server or trigger a denial‑of‑service condition by sending specially crafted input. The weakness corresponds to CWE‑99, which covers improper resource handling that can lead to unauthorized access or denial of availability.

The issue affects GitLab Community Edition and Enterprise Edition installations whose versions fall within the following ranges: 18.2.7 up to but not including 19.1.8, 19.2.x up to but not including 19.2.6, and 19.3.x up to but not including 19.3.2. These versions are marked as vulnerable until the indicated patch releases. The remediation is to upgrade to at least GitLab 19.1.8, 19.2.6, or 19.3.2, respectively.

The CVSS base score is 3.1, reflecting a low‑severity problem. The EPSS score is below 1 %, which suggests a very low probability of exploitation at present. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated user with project-level access; an attacker would need to supply a malicious Terraform state file via the upload endpoint. Given the low CVSS score, low EPSS, and lack of publicly known exploits, the overall risk is moderate but not negligible for environments with many project-level users who can upload Terraform state files.