InfoSecBulletin Cybersecurity for mankind
GitLab has released security updates for its Community Edition (CE) and Enterprise Edition (EE) to fix vulnerabilities that could enable cross-site scripting (XSS) attacks and bypass group restrictions.
CVE-2025-6948 is a critical cross-site scripting (XSS) vulnerability with a CVSS score of 8.7. It affects all versions prior to 17.11.6, 18.0.4, and 18.1.2. GitLab states that this flaw lets attackers execute actions for users by injecting harmful content, potentially compromising sessions, altering project data, or enabling phishing attacks.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
CVE-2025-3396 is a flaw in GitLab CE/EE versions from 13.3 to 17.11.6, 18.0 to 18.0.4, and 18.1 to 18.1.2 that involves improper authorization. It has a CVSS score of 4.3 and lets authenticated project owners bypass forking restrictions by manipulating the API.
CVE-2025-4972 affects only GitLab EE and has a CVSS score of 2.7. Authenticated users with group invitation rights can bypass admin restrictions through specially crafted API requests. Affected versions are 18.0 prior to 18.0.4 and 18.1 prior to 18.1.2.
The new vulnerability in GitLab EE, CVE-2025-6168, affects versions 18.0 before 18.0.4 and 18.1 before 18.1.2, with a CVSS score of 2.7. It allows maintainers to invite users to restricted groups through special API requests, bypassing admin controls.
GitLab has upgraded its rsync utility to version 3.4.1 to fix vulnerabilities CVE-2024-12084 and CVE-2024-12088. They advise all self-managed GitLab administrators to update to versions 18.1.2, 18.0.4, or 17.11.6 right away.
“We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” GitLab stated in its advisory.
