Unrestricted file upload leads to Stored XSS #880099 Valid Cross-site Scripting – 2020-08-03 – 90 New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields #1578400 Valid Cross-site Scripting – 2022-11-16 $13,950 93 XSS in request approvals #402658 Valid Cross-site Scripting – 2021-04-23 $3,000 96 Bypass: Stored-XSS with CSP-bypass via scoped labels' color #1693150 Valid Cross-site Scripting – 2023-02-19 – 96 Account takeover due to insufficient URL validation on RelayState parameter #1923672 Valid Cross-Site Request Forgery Medium 2023-05-30 $2,450 99 Group search with Elastic search enable leaks unrelated data #708820 Valid Access Control – 2019-12-14 – 100 CSP-bypass XSS in project settings page #1588732 Valid Cross-site Scripting – 2022-11-16 – 100 Able to view hackerone reports attachments #979787 Valid Information Disclosure – 2022-07-11 – 103 Read files on application server, leads to RCE #178152 Valid Information Disclosure – 2016-11-03 – 114 IDOR Exposes All Machine Learning Models #2528293 Valid Insecure Direct Object Reference Medium 2024-10-01 $1,160 117 Git flag injection - Search API with scope 'blobs' Analysed #682442 Valid Command and Code Injection – 2019-12-15 $7,000 130 Stored XSS in custom emoji Analysed #1198517 Valid Cross-site Scripting – 2021-07-19 $3,000 130 Private objects exposed through project import Analysed #767770 Valid Insecure Direct Object Reference – 2022-06-07 $20,000 133 Send arbitrary PUT requests when user clicks on a link Analysed #824689 Valid Command and Code Injection – 2020-07-27 – 135 Persistent XSS in Note objects Analysed #508184 Valid Cross-site Scripting – 2019-07-19 $4,500 139 Mint Oauth2 access token for targeted user Analysed #1148364 Valid Authentication High 2025-07-23 $5,580 140 Path traversal, to RCE Analysed #733072 Valid Command and Code Injection – 2022-06-07 $12,000 142 DoS on the Issue page by exploiting Mermaid. Analysed #470067 Valid Denial of Service – 2019-05-13 $3,000 145 information disclosure of secret_key_base via encoding charcters Analysed #460545 Valid Information Disclosure – 2019-06-13 $3,500 146 Importing GitLab project archives can replace uploads of other users Analysed #534794 Valid Insecure Direct Object Reference – 2019-12-11 – 148 Stored XSS in Notes (with CSP bypass for gitlab.com) Analysed #1481207 Valid Cross-site Scripting – 2022-05-25 – 161 Snippet JS template allows attacker to read a user's private snippets Analysed #348443 Valid Information Disclosure – 2019-03-03 $300 165 Git flag injection leading to file overwrite and potential remote code execution Analysed #653125 Valid Command and Code Injection – 2019-12-19 $3,500 169 Stored-XSS with CSP-bypass via labels' color Analysed #1665658 Valid Cross-site Scripting – 2023-02-19 – 169 Arbitrary file read during project import Analysed #1132378 Valid File and Path Handling – 2021-05-24 $16,000 194 Group search leaks private MRs, code, commits Analysed #692252 Valid Access Control – 2019-12-14 – 212 Ability To Delete User(s) Account Without User Interaction Analysed #928255 Valid Misconfiguration and Insecure Design – 2021-03-17 – 221 Full Read SSRF on Gitlab's Internal Grafana #878779 Valid Server-Side Request Forgery – 2020-08-07 – 229 Unauthenticated blind SSRF in OAuth Jira authorization controller Analysed #398799 Valid Server-Side Request Forgery – 2019-03-14 $4,000 238 Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domain Analysed #565883 Valid Input Validation and Logic – 2019-08-30 – 249 Steal private objects of other projects via project import Analysed #743953 Valid Insecure Direct Object Reference – 2022-06-07 $20,000 254 Privilege escalation from any user (including external) to gitlab admin when admin impersonates you Analysed #493324 Valid Access Control – 2020-08-26 – 256 Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties Analysed #922456 Valid Authentication – 2020-10-01 $3,000 257 RCE via github import #1672388 Valid Command and Code Injection – 2022-11-16 – 271 Cross-site Scripting (XSS) - Stored in RDoc wiki pages Analysed #662287 Valid Misconfiguration and Insecure Design – 2019-12-16 $3,500 282 Stored XSS via Kroki diagram Analysed #1731349 Valid Cross-site Scripting High 2023-06-02 $13,950 295 Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.com Analysed #498964 Valid Access Control – 2019-04-19 – 306 An attacker can run pipeline jobs as arbitrary user Analysed #894569 Valid Input Validation and Logic – 2020-08-26 $12,000 307 Stored XSS in markdown via the DesignReferenceFilter Analysed #1212067 Valid Cross-site Scripting – 2021-10-18 $16,000 317 Arbitrary file read via the bulk imports UploadsPipeline Analysed #1439593 Valid File and Path Handling – 2022-03-21 $29,000 329 Server Side Request Forgery mitigation bypass Analysed #632101 Valid Server-Side Request Forgery – 2020-04-18 – 350 Attacker is able to access commit title and team member comments which are supposed to be private Analysed #502593 Valid Access Control – 2019-07-03 – 351 SSRF on project import via the remote_attachment_url on a Note Analysed #826361 Valid Server-Side Request Forgery – 2020-06-07 $10,000 359 Bypass of GitLab CI runner slash fix in YAML validation Analysed #409395 Valid Input Validation and Logic – 2019-04-10 – 363 JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions Analysed #509924 Valid Information Disclosure – 2019-04-20 $12,000 366 RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag) Analysed #1609965 Valid Command and Code Injection – 2022-09-13 $33,510 387 Remote Command Execution via Github import Analysed #1679624 Valid Command and Code Injection – 2022-10-06 $33,510 392 gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read Analysed #850447 Valid Information Disclosure – 2020-06-08 $10,000 410 RCE via unsafe inline Kramdown options when rendering certain Wiki pages Analysed #1125425 Valid Command and Code Injection – 2021-04-20 $20,000 427 Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control – 2019-11-27 $12,000 457