Medium severity5.0NVD Advisory· Published Aug 27, 2025· Updated Jun 17, 2026
CVE-2025-5101
CVE-2025-5101
Description
An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that under certain conditions could have allowed an authenticated attacker to distribute malicious code that appears harmless in the web interface by taking advantage of ambiguity between branches and tags during repository imports.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
44cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 0
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: <18.1.5
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: <18.1.5
- cpe:2.3:a:gitlab:gitlab:18.3.0:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:18.3.0:*:*:*:enterprise:*:*:*
- (no CPE)range: <18.1.5, <18.2.5, <18.3.1
- Range: <18.1.5, <18.2.5, <18.3.1
- osv-coords37 versionspkg:apk/chainguard/gitlab-docker-machine-18.1pkg:apk/chainguard/gitlab-docker-machine-18.2pkg:apk/chainguard/gitlab-docker-machine-fips-18.1pkg:apk/chainguard/gitlab-docker-machine-fips-18.2pkg:apk/chainguard/gitlab-runner-18.1pkg:apk/chainguard/gitlab-runner-18.2pkg:apk/chainguard/gitlab-runner-fips-18.1pkg:apk/chainguard/gitlab-runner-fips-18.2pkg:apk/chainguard/gitlab-runner-helper-18.1pkg:apk/chainguard/gitlab-runner-helper-18.2pkg:apk/chainguard/gitlab-runner-helper-compat-18.1pkg:apk/chainguard/gitlab-runner-helper-compat-18.2pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.1pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.2pkg:apk/chainguard/gitlab-runner-helper-fips-18.1pkg:apk/chainguard/gitlab-runner-helper-fips-18.2pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.1pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.2pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.1pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.2pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.1pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.2pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.1pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.2pkg:apk/wolfi/gitlab-docker-machine-18.1pkg:apk/wolfi/gitlab-docker-machine-18.2pkg:apk/wolfi/gitlab-runner-18.1pkg:apk/wolfi/gitlab-runner-18.2pkg:apk/wolfi/gitlab-runner-helper-18.1pkg:apk/wolfi/gitlab-runner-helper-18.2pkg:apk/wolfi/gitlab-runner-helper-compat-18.1pkg:apk/wolfi/gitlab-runner-helper-compat-18.2pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.1pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.2pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.1pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.2pkg:bitnami/gitlab
< 18.1.3-r1+ 36 more
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.2.2-r0
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.2.2-r1
- (no CPE)range: < 18.1.5
Patches
Vulnerability mechanics
References
2- gitlab.com/gitlab-org/gitlab/-/issues/545165nvdBroken Link
- hackerone.com/reports/3124199nvdPermissions Required
News mentions
1- GitLab Patch Release: 18.3.1, 18.2.5, 18.1.5GitLab Security Releases · Aug 27, 2025