GCVE-110-NCSC-2026-62

Advisory PublishedCVSS 4.3/10

Vulnetix · Advisory published February 11, 2026

GitLab has addressed a vulnerability in versions prior to 18.6.6, 18.7.4, and 18.8.4 that allowed authenticated users to exploit server-side request forgery via the Git repository import feature.

Download JSON Open in Console

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-862Missing AuthorizationCWE-639Authorization Bypass Through User-Controlled KeyCWE-770Allocation of Resources Without Limits or ThrottlingCWE-436Interpretation ConflictCWE-1289Improper Validation of Unsafe Equivalence in InputCWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Risk Scores

CVSS 3.1

4.3/10

Medium · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
GitLab	vers:unknown/*	—	—
Open Source	vers:unknown/*	—	—

Aliases

CVE-2025-12073 CVE-2025-12575 CVE-2025-14560 CVE-2025-14592 CVE-2025-14594 CVE-2025-7659 CVE-2025-8099 CVE-2026-0595 CVE-2026-0958 CVE-2026-1080 CVE-2026-1094 CVE-2026-1282 CVE-2026-1387 CVE-2026-1456 CVE-2026-1458

References

advisory

Browse GCVE Records

73,044 records in the GCVE database · Updated July 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON