CyberSecBulletin
CVE-2025-1908NVD status: Analyzed

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users'…

Published Updated By the CyberSecBulletin desk

CVE-2025-1908 is a high-severity vulnerability in GitLab, with a CVSS 3.1 base score of 7.7 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, but only if a user takes part, for example by opening a link or file. The record lists versions 17.9.7, 17.10.5, 17.11.1 as the first without the flaw, so updating GitLab to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.39% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update GitLab to 17.9.7 or 17.10.5 or 17.11.1, whichever matches your release line, or a later version.
  2. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
GitLabGitLab16.6 up to, but not including, 17.9.7; 17.10 up to, but not including, 17.10.5; 17.11 up to, but not including, 17.11.117.9.7, 17.10.5, 17.11.1

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. Scored by CNA (gitlab.com).

Official description

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Technical write-ups (may include proof of concept)

Other references

Other vulnerabilities in GitLab

All GitLab vulnerabilities

Spotted an error? Tell us.