Main Vulnerability Database Vulnerabilities #VU119825

Improper Encoding or Escaping of Output in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2025-8405

Published: December 11, 2025

Vulnerability identifier: #VU119825

CSH Severity: Medium

CVSS v4: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N]

CVE-ID: CVE-2025-8405

CWE-ID: CWE-116

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper encoding in vulnerability reports. A remote user can inject malicious HTML into vulnerability code flow displays and perform unauthorized actions on behalf of other users.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

How to mitigate CVE-2025-8405

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 18.4.6, 18.5.4, 18.6.2
GitLab Enterprise Edition - addressed in versions 18.4.6, 18.5.4, 18.6.2

External References

https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/

Related Security Bulletins