An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource abuse and unauthorized content storage.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/521619 | Broken Link |
| https://hackerone.com/reports/3009067 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
12 Aug 2025, 14:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/521619 - Broken Link | |
| References | () https://hackerone.com/reports/3009067 - Permissions Required | |
| First Time |
Gitlab gitlab
Gitlab |
|
| CPE | cpe:2.3:a:gitlab:gitlab:18.1.0:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:18.1.0:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
26 Jun 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-26 06:15
Updated : 2025-08-12 14:41
NVD link : CVE-2025-1754
Mitre link : CVE-2025-1754
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-306
Missing Authentication for Critical Function