GitLab Improper Path Validation Vulnerability Allowing Cross-Site Scripting

A vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 18.10 prior to 18.10.4 and 18.11 prior to 18.11.1. This vulnerability could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session. The issue stems from improper path validation under certain conditions, which could have been exploited to inject malicious scripts.

Impact

Exploitation of this vulnerability could lead to cross-site scripting (XSS) attacks, allowing for the execution of malicious scripts in the context of the user's browser session.

Remediation

Users are advised to upgrade to GitLab versions 18.11.1, 18.10.4, or 18.9.6. Instructions for updating GitLab can be found on the GitLab Update page. This patch includes important security fixes, but be aware that it may cause downtime during the upgrade process for single-node instances.