AIKIDO-2026-582012

@zereight/mcp-gitlab is vulnerable to Path Traversal

Path TraversalGHSA-4rm9-rfp2-j39q Published Jul 21, 2026

High Risk

This Affects:

@zereight/mcp-gitlab

2.0.8 - 2.1.40

Fixed in 2.1.41

Are you affected? Scan for Free

TL;DR

The download_release_asset tool accepts direct_asset_path as an unrestricted string and appends it directly to the GitLab release-download API URL under /projects/{id}/releases/{tag}/downloads/{direct_asset_path}. A caller who can influence that argument can supply ../ dot segments that the URL/fetch stack normalizes, escaping the intended release-download route into another GitLab API path on the same configured host, still carrying the operator's personal access token. This enables same-host path confusion and project-scope bypass, defeating GITLAB_ALLOWED_PROJECT_IDS restrictions and reaching resources of other projects. The fix rejects and URL-encodes dangerous GitLab path segments (disallowing . and ..) before interpolation and adds safe attachment-filename validation for downloads.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and an MCP caller can influence the direct_asset_path argument of the download_release_asset tool, with the greatest impact when GITLAB_ALLOWED_PROJECT_IDS is relied on as a project-scope control.