CVE-2024-0402 | An issue has been discovered in GitLab CE/EE affecting all v… | CVSS 9.9 CRITICAL

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.

Metadata

CVE ID: CVE-2024-0402
State: PUBLISHED
Assigner: GitLab
Reserved: 2024-01-10 16:30 UTC
Published: 2024-01-26 01:02 UTC
Last updated: 2026-06-03 04:08 UTC
Primary CWE: CWE-22
CWE-22: Improper Limitation of a Pathname to a Restricted Di…
Vendor / Product: GitLab / GitLab
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
GitLab	GitLab	—	16.0 < 16.5.8, 16.6 < 16.6.6, 16.7 < 16.7.4, 16.8 < 16.8.1

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)