CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-85706GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read | GitLab · GitLab | Exploited | 10.0 | 97% | 2026-09-12 |
| CVE-2023-2825GitLab 16.0.0 - Path Traversal | GitLab · GitLab | Public check | 10.0 | 72% | 2023-05-26 |
| CVE-2018-14364GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code executio… | Gitlab · Gitlab | Likely | – | 48% | 2018-07-18 |
| CVE-2020-10977GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects. | Gitlab · Gitlab | Likely | – | 43% | 2020-04-08 |
| CVE-2024-2434Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | GitLab · GitLab | Likely | 8.5 | 23% | 2024-04-25 |
| CVE-2019-6783An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulne… | Gitlab · Gitlab | Possible | – | 6.2% | 2019-09-09 |
| CVE-2017-0918Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution. | GitLab · GitLab Community and Enterprise Editions | Possible | – | 4.3% | 2018-03-21 |
| CVE-2024-0402Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | GitLab · GitLab | Possible | 9.9 | 3.8% | 2024-01-26 |
| CVE-2019-19628In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code executi… | Gitlab · Gitlab | Possible | – | 3.6% | 2020-01-05 |
| CVE-2018-3710Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution. | GitLab · GitLab Community and Enterprise Editions | Possible | – | 2.8% | 2018-03-21 |
| CVE-2020-13347A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker exec… | GitLab · GitLab Runner | Possible | 9.1 | 2.3% | 2020-10-07 |
| CVE-2018-19856GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API. | Gitlab · Gitlab | Possible | – | 2.3% | 2019-03-26 |
| CVE-2018-20144GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control. | Gitlab · Gitlab | Possible | – | 2.2% | 2019-03-28 |
| CVE-2019-6240An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal. | Gitlab · Gitlab | Possible | – | 2.2% | 2019-03-25 |
| CVE-2022-0244An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file. | GitLab · GitLab | Possible | 8.6 | 1.8% | 2022-01-18 |
| CVE-2018-20229GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal. | Gitlab · Gitlab | Possible | – | 1.7% | 2019-04-04 |
| CVE-2020-13355An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific… | GitLab · GitLab CE/EE | Possible | 7.5 | 1.7% | 2020-11-18 |
| CVE-2019-19088Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal. | Gitlab · Gitlab | Possible | – | 1.7% | 2020-01-03 |
| CVE-2020-7966GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal. | Gitlab · Gitlab | Possible | – | 1.6% | 2020-02-05 |
| CVE-2020-10953In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue. | Gitlab · Gitlab | Possible | – | 1.6% | 2020-03-27 |
| CVE-2021-22190A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token | GitLab · GitLab | Possible | 8.5 | 1.6% | 2021-04-12 |
| CVE-2019-9222An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions. | Gitlab · Gitlab | Possible | – | 1.5% | 2019-04-17 |
| CVE-2020-26405Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >… | GitLab · GitLab CE/EE | Possible | 7.1 | 1.5% | 2020-11-17 |
| CVE-2022-2531An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 b… | GitLab · GitLab | Possible | 5.3 | 1.4% | 2022-08-05 |
| CVE-2022-3060Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause… | GitLab · GitLab | Possible | 7.3 | 1.3% | 2022-10-17 |
| CVE-2020-10086GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read. | Gitlab · Gitlab | Possible | – | 1.3% | 2020-03-13 |
| CVE-2020-12448GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet. | Gitlab · Gitlab | Possible | – | 1.3% | 2020-05-07 |
| CVE-2020-13279Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system | GitLab · gitlab-vscode-extension | Possible | 8.6 | 1.2% | 2020-06-22 |
| CVE-2021-22195Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system | GitLab · gitlab-vscode-extension | Possible | 8.6 | 1.1% | 2021-04-01 |
| CVE-2022-3478An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 befo… | GitLab · GitLab | Possible | 4.3 | 1.0% | 2023-01-24 |
| CVE-2026-10053Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | GitLab · GitLab | Unlikely | 8.5 | 0.9% | 2026-08-23 |
| CVE-2023-3385Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | GitLab · GitLab | Unlikely | 6.3 | 0.9% | 2023-08-01 |
| CVE-2024-8647Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | GitLab · GitLab | Unlikely | 5.4 | 0.4% | 2024-12-12 |
| CVE-2025-1042Files or Directories Accessible to External Parties in GitLab | GitLab · GitLab | Unlikely | 4.9 | 0.4% | 2025-02-12 |
| CVE-2026-5816Improper Resolution of Path Equivalence in GitLab | GitLab · GitLab | Unlikely | 8.0 | 0.4% | 2026-04-22 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.