Main Vulnerability Database Vulnerabilities #VU134380

Input validation error in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2026-6976

Published: June 11, 2026

Vulnerability identifier: #VU134380

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-6976

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to hide changes from merge request diff views.

The vulnerability exists due to improper input validation in merge request diff when processing file names. A remote user can use crafted file names to hide changes from merge request diff views.

User interaction is required.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

How to mitigate CVE-2026-6976

Install security update from vendor's website.

Gitlab Community Edition - addressed in versions 18.10.8, 18.11.5, 19.0.2
GitLab Enterprise Edition - addressed in versions 18.10.8, 18.11.5, 19.0.2

External References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-2-released/

Related Security Bulletins