Source: BleepingComputer
Author: Sergiu Gatlan
URL: https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/
ONE SENTENCE SUMMARY:
GitLab released urgent patches for critical path traversal and deserialization flaws, warning self-managed users to upgrade immediately to prevent sensitive data exposure.
MAIN POINTS:
- Maximum-severity path traversal vulnerability tracked as CVE-2023-2825 prompted immediate patching guidance.
- Researcher “s3ntago” reported the issue via GitLab’s HackerOne bug bounty program.
- Root cause involves improper path confinement and missing authentication in repository commits API.
- Unauthenticated attackers could read arbitrary files from vulnerable GitLab servers under conditions.
- Second critical flaw, CVE-2026-87719, involves insecure deserialization in GraphQL subscription serializer.
- CVE-2026-87719 impacts GitLab EE and requires authenticated Duo Chat access.
- Exploitation could expose sensitive credentials and Advanced Search instance configurations.
- Fixes shipped in GitLab CE/EE versions 19.3.2, 19.2.6, and 19.1.x releases.
- GitLab.com already runs patched code; GitLab Dedicated customers need no action.
- CISA has listed multiple GitLab vulnerabilities as exploited since 2021, underscoring active risk.
TAKEAWAYS:
- Upgrade self-managed GitLab immediately to patched versions to reduce exposure windows.
- Enforce strong API authentication and path confinement to prevent traversal-style data leaks.
- Treat deserialization in GraphQL-related components as high-risk and audit serializers rigorously.
- Monitor CISA exploited-vulnerability listings to prioritize patching and threat-informed remediation.
- Past GitLab security incidents show recurring attacker interest, requiring continuous vulnerability management.