GitLab Vulnerabilities Allow File Manipulation, Bypass, DoS, Info Disclosure, XSS

CERT-Bund has released a security advisory (WID-SEC-2026-0847) concerning multiple critical vulnerabilities in GitLab, rated with a high CVSS Base Score of 8.1. These vulnerabilities, affecting open-source GitLab versions prior to 18.10.1, 18.9.3, and 18.8.7, can be exploited remotely by attackers to manipulate files, bypass security controls, execute denial-of-service attacks, disclose sensitive information, and perform cross-site scripting (XSS) attacks.

Organizations using affected GitLab versions should immediately update to the patched versions (18.10.1, 18.9.3, or 18.8.7, depending on the branch) to mitigate these risks. Failure to update could lead to significant security breaches, data compromise, and service disruptions. The advisory indicates that mitigation is available, implying that patching is the primary recommended action.