GitLab CE/EE Information Disclosure Vulnerability in Mermaid Diagram Rendering

A vulnerability allowing information disclosure has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 10.3 prior to 18.5.5, 18.6 prior to 18.6.3, and 18.7 prior to 18.7.1. This vulnerability could have allowed a user to leak sensitive connection information by referencing specially crafted images that bypassed asset proxy protection.

Impact

Exploitation of this vulnerability could have led to unauthorized information disclosure, allowing users to access sensitive connection details.

Remediation

Users are advised to upgrade to GitLab versions 18.7.1, 18.6.3, or 18.5.5. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, see the Updating the Runner page.