GitLab's repository import function could allow an authenticated user to supply a secondary URL that triggers a server‑side request to the internal Gitaly service. The lack of validation enabled the attacker to read arbitrary files from the Gitaly server and to access internal network resources. This flaw can be used to exfiltrate confidential data and potentially discover other servers on the internal network.

GitLab GitLab is affected in all Community Edition and Enterprise Edition releases from 18.10 prior to 18.10.8, from 18.11 prior to 18.11.5, and from 19.0 prior to 19.0.2.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and occurs during repository import, making it a targeted threat. Because only authenticated users can trigger the import, the risk is limited to accounts with import privileges. Attackers could use this to read internal files and probe the internal network once the import feature is triggered.