CVE-2025-1754

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource abuse and unauthorized content storage.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/521619	Broken Link
https://hackerone.com/reports/3009067	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:18.1.0::::community:::
	cpe:2.3:a:gitlab:gitlab:18.1.0::::enterprise:::

History

12 Aug 2025, 14:41

Type	Values Removed	Values Added
CPE		cpe:2.3:a:gitlab:gitlab:18.1.0::::enterprise::: cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:18.1.0::::community::: cpe:2.3:a:gitlab:gitlab:::::community:::*
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/521619 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/521619 - Broken Link
References	~~() https://hackerone.com/reports/3009067 -~~	() https://hackerone.com/reports/3009067 - Permissions Required
First Time		Gitlab gitlab Gitlab

26 Jun 2025, 18:57

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-26 06:15

Updated : 2025-08-12 14:41

NVD link : CVE-2025-1754

Mitre link : CVE-2025-1754

CVE.ORG link : CVE-2025-1754

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-1754", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-06-26T06:15:22.570", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/521619", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/3009067", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource abuse and unauthorized content storage."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 17.2 hasta la 17.11.5, la 18.0 hasta la 18.0.3 y la 18.1 hasta la 18.1.1 que podr\u00eda haber permitido a atacantes no autenticados cargar archivos arbitrarios en proyectos p\u00fablicos mediante el env\u00edo de solicitudes de API manipuladas, lo que podr\u00eda provocar un abuso de recursos y un almacenamiento de contenido no autorizado."}], "lastModified": "2025-08-12T14:41:54.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "E561C0D3-12B9-432E-9FAC-4C7B7D5EEC38", "versionEndExcluding": "17.11.5", "versionStartIncluding": "17.2.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "61CA81F1-7FD4-4616-84FA-F23243CDB4C8", "versionEndExcluding": "17.11.5", "versionStartIncluding": "17.2.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "12A2A86E-8DD7-482C-8CAD-191E0E5C635D", "versionEndExcluding": "18.0.3", "versionStartIncluding": "18.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "912DFFB2-0D98-4506-AEB6-2AC3C2330554", "versionEndExcluding": "18.0.3", "versionStartIncluding": "18.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:18.1.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "792C874D-21C4-4715-95B8-489B65F7AE0D"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:18.1.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "1FA1F1D0-87EA-44A6-AFB7-267BB21A7412"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}