Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package registry.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-23T10:16:27.140Z",
  "pubdate": "2026-08-23T10:16:27.140Z",
  "executiveSummary": "A path traversal vulnerability has been identified within the package registry component of GitLab CE/EE. This security flaw under specific conditions enables an authenticated user to achieve remote code execution on the underlying system. The vulnerability impacts all versions of GitLab CE/EE ranging from 18.8 prior to 19.0.6, versions 19.1 prior to 19.1.4, and versions 19.2 prior to 19.2.2.\nThe primary risk implication is a complete system compromise, as successful exploitation permits arbitrary code execution within the context of the GitLab application environment. Threat actors must possess authenticated access to the platform to leverage this flaw. The attack vector targets the package registry handling logic, specifically abusing insecure file path resolution mechanisms during package management operations.\nOrganizations operating affected GitLab instances face severe confidentiality, integrity, and availability risks if malicious actors successfully execute the exploit. The severity of this vulnerability necessitates immediate remediation through applied software updates provided by the vendor.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient sanitization and validation of user-supplied input handled by the package registry component within GitLab CE/EE. Specifically, path traversal sequences embedded within package operations are improperly filtered, allowing malicious input to manipulate the file system path resolution process.\nThe vulnerable component resides within the package registry subsystem responsible for processing uploaded or requested package files. Affected software versions include GitLab CE/EE from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.\nExploitation requires the attacker to hold an authenticated user account within the target GitLab instance. Network exposure is inherent to the web-based nature of the package registry interface. Privileges required are limited to standard authenticated capabilities, provided specific trigger conditions are met within the registry interaction flow.\nThe attack flow proceeds as follows: an authenticated attacker crafts a malicious package containing path traversal sequences directed at sensitive or executable directories within the application file system. When the package registry processes this payload, the lack of robust input validation causes the application to navigate outside the intended storage directory boundaries. By traversing the directory structure, the attacker can write or overwrite critical application files or executable scripts.\nPost-exploitation impact involves achieving remote code execution. Because the application processes the manipulated files, the injected instructions or scripts are executed by the hosting server context, potentially granting the attacker full control over the GitLab instance and access to internal repositories, configuration secrets, and connected infrastructure."
}