Volerion logoVolerion
Volerion logoVolerion

GitLab CE/EE Incorrect Reference Vulnerability in Repository Download

Vulnerability

A vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 1.0 prior to 18.7.6, 18.8 prior to 18.8.6, and 18.9 prior to 18.9.2. This vulnerability allows an authenticated user to manipulate repository downloads, causing them to contain different code than what is displayed in the web interface. This discrepancy arises from improper validation of branch references under certain conditions.

Impact

Exploitation of this vulnerability leads to repository downloads containing altered code, creating a mismatch with the web interface representation.

Remediation

Users are advised to upgrade to GitLab versions 18.9.2, 18.8.6, or 18.7.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, refer to the Updating the Runner page.

Added: Mar 11, 2026, 4:27 PM
Updated: Mar 11, 2026, 4:27 PM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
0.6
exploitability
6.3
remediation
7.7
relevance
3.8
threat
6.4
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.