GitLab · weakness class
File and Path Handling
21 CVEs · 1 exploited
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 1
- check available
- 1
- likely to be exploited
- 1
Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.
- GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read
- GitLab 16.0.0 - Path Traversal
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution.
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution.
- A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker exec…
- An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file.
- An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific…
- A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token
- Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >…
- An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 b…
- Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause…
- Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system
- Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system
- An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 befo…
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- Files or Directories Accessible to External Parties in GitLab
- Improper Resolution of Path Equivalence in GitLab
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.