CVE-2025-6948

Published Jul 10, 2025

Last updated 8 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6948 is a vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). It affects versions 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2. The vulnerability allows an attacker to execute actions on behalf of other users through malicious content injection. This is due to improper input validation or sanitization within GitLab's web interface. Under certain conditions, the vulnerability permits malicious code or content to be injected and subsequently executed or used to perform unauthorized actions. An attacker can craft malicious content that, when viewed or processed by a victim, triggers actions on their behalf. This could involve malicious scripts or specially crafted content that exploits parsing or rendering vulnerabilities.

Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.
Source: cve@gitlab.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.7
Impact score: 5.8
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Severity: HIGH

Weaknesses

cve@gitlab.com: CWE-79

Hype score: Not currently trending

References