Unrated severityNVD Advisory· Published Sep 29, 2023· Updated Nov 20, 2025
Improper Validation of Specified Type of Input in GitLab
CVE-2023-3906
Description
An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.
Affected products
3- Range: >=12.3, <16.2.8; >=16.3, <16.3.5; >=16.4, <16.4.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- hackerone.com/reports/2071411mitretechnical-descriptionexploitpermissions-required
- gitlab.com/gitlab-org/gitlab/-/issues/419213mitreissue-tracking
News mentions
1- GitLab Security Release: 16.4.1, 16.3.5, and 16.2.8GitLab Security Releases · Sep 28, 2023