GitLab CE/EE: malicious wiki content can drive unauthorized actions as another user

Impact

An authenticated GitLab user can craft wiki page content that, when another user views it, performs actions on that user's behalf. On a self-hosted GitLab that drives a GPU fleet, the account being impersonated is often one with runner, registry or deployment rights, so the useful version of this risk is a low-privileged project member escalating through a maintainer who opens a wiki page. GitLab's advisory is deliberately thin - it does not name the sink or the exact set of reachable actions - so treat scope as 'anything the victim's session can do in GitLab' and no more. The scoring (scope-changing, user interaction required) matches a content-injection class issue rather than direct server compromise.

Who can reach it

Any authenticated user who can create or edit a wiki page in a project the target user visits. Requires the victim to view the page (UI:R). Not exploitable by anonymous users unless your instance allows public registration and public project wikis.

What to do

Upgrade the GitLab instance to 18.4.6, 18.5.4 or 18.6.2 depending on your branch, then restart the GitLab services - this is a control-plane application upgrade, not a node-level maintenance window, so GPU nodes keep running and only CI/CD and registry access pause for the restart. Omnibus and chart deployments follow the normal patch-release path; nothing needs to be flashed or drained.

References

Related entries

• Cisco Nexus Dashboard Fabric Controller (SSH host key validation): NDFC does not validate the SSH host keysCVE-2025-20163 · Cisco Nexus Dashboard Fabric Controller (SSH host key validation)High
• MinIO (S3 API, unsigned-trailer uploads): Signature validation on unsigned-trailer uploads is incomplete, so knowingCVE-2025-31489 · MinIO (S3 API, unsigned-trailer uploads)High
• HPE OneView for VMware vCenter (vertical privilege escalation): A read-only user performs administrative actionsCVE-2025-37101 · HPE OneView for VMware vCenter (vertical privilege escalation)High
• MinIO Java SDK: XML tag values substitute system properties and environment variables, exposing credentialsCVE-2025-59952 · MinIO Java SDK (minio-java XML response parsing)High
• F5 BIG-IP (iHealth command / tmsh restricted shell): An authenticated attacker with at least a resource-administratorCVE-2025-61958 · F5 BIG-IP (iHealth command / tmsh restricted shell)High
• External Secrets Operator: BeyondTrust provider reads referenced Secrets across namespaces without validationCVE-2025-62159 · External Secrets Operator (BeyondTrust provider)High