AIKIDO-2026-253975
gitlab-ce is vulnerable to Path Traversal
85
High Risk
This Affects:
gitlab-ceTL;DR
The package registry fails to confine package file paths to the intended storage directory. An authenticated user can supply traversal sequences that escape that directory and write attacker-controlled content where it can be executed, leading to remote code execution on the GitLab instance. The fix validates and confines package registry paths so they cannot escape the designated storage root.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
gitlab-ce is vulnerable to Path Traversal in versions 18.8.0 - 19.0.5, 19.1.0 - 19.1.3 and 19.2.0 - 19.2.1.
How to fix this
Upgrade the gitlab-ce and/or the gitlab-ee library to the patch version.
Links
docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/gitlab.com/gitlab-org/gitlab/-/work_items/601596hackerone.com/reports/3754194
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant