Information disclosure in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2025-3950
Published: January 7, 2026
Vulnerability identifier: #VU121079
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2025-3950
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in Mermaid diagram rendering. A remote user can obtain sensitive connection information by referencing specially crafted images that bypass asset proxy protection.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2025-3950
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 18.5.5, 18.6.3, 18.7.1
Gitlab Community Edition - addressed in versions 18.5.5, 18.6.3, 18.7.1
Gitlab Community Edition - addressed in versions 18.5.5, 18.6.3, 18.7.1