Database/Control plane, storage & DevOps
GitLab CE/EE: improper path validation lets an unauthenticated attacker run JavaScript in a user's session
Impact
Under certain conditions GitLab does not validate a path properly, and an unauthenticated attacker can get arbitrary JavaScript to run in a victim's GitLab browser session. Script in a maintainer's or admin's session can do anything that user can do: edit CI configuration, read CI variables, or change runner settings. On a self-hosted GitLab that drives GPU build and training pipelines, that is a route to the CI infrastructure. The record does not describe the exact conditions.
Who can reach it
A remote attacker with no account, who needs a victim to interact with a crafted link or page (UI:R). The impact depends on the victim's GitLab role.
What to do
Upgrade GitLab to 18.10.4 or 18.11.1. Only versions from 18.10 are affected. This is an application upgrade and service restart on the GitLab host, with no fleet maintenance window.
References
Related entries
- Apache Airflow FAB provider: a DAG named 'DAGs' collides with the global all-DAGs permission and escalates privilegesCVE-2026-59245 · Apache Airflow FAB auth manager (apache-airflow-providers-fab, resource_name collision)High
- Linux MACsec (replay protection at XPN lower-PN wrap): MACsec replay protection fails at the extended-packet-numberCVE-2026-63925 · Linux MACsec (replay protection at XPN lower-PN wrap)High
- Atlantis: workspace names escape the working directory into os.RemoveAll and os.MkdirAllCVE-2026-64679 · Atlantis (workspace path handling in atlantis.yaml and /api/plan)High
- NVIDIA AIStore: path traversal in target-side object rename writes files outside the bucketCVE-2026-65103 · NVIDIA AIStore (target-side object rename handler)High
- NVIDIA AIStore: dSort archive extraction honours traversal paths in member namesCVE-2026-65164 · NVIDIA AIStore (dSort archive extraction)High
- Dell PowerStore T SDNAS: unauthenticated NFS/RPC buffer overflow allows command execution on the arrayCVE-2026-70415 · Dell PowerStore T SDNAS (NFS/RPC service)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.