High-Severity GitLab XSS Flaw (CVE-2025-12716) Risks Session Hijack via Malicious Wiki Pages

GitLab has rolled out a patch for a high-severity XSS flaw, CVE-2025-12716, that could allow an authenticated user to create malicious wiki pages and trick the system into performing actions on behalf of another user, potentially enabling session hijack. The issue affects GitLab Community Edition and Enterprise Edition versions starting from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2, with the update addressing a range of vulnerabilities from XSS to information leaks.

The headlining fix is accompanied by changes that curb several injection-style attacks where user input was not properly sanitised, and it is accompanied by other CVEs such as CVE-2025-8405, CVE-2025-12734 and CVE-2025-13978. GitLab[.]com and GitLab Dedicated environments have already been patched, but self-managed instances remain at risk until updated, so administrators are urged to upgrade to 18.6.2, 18.5.4, or 18.4.6 as soon as possible.