InfoSecBulletin Cybersecurity for mankind
GitLab has released security updates for its Community Edition (CE) and Enterprise Edition (EE) to fix vulnerabilities that could enable cross-site scripting (XSS) attacks and bypass group restrictions.
CVE-2025-6948 is a critical cross-site scripting (XSS) vulnerability with a CVSS score of 8.7. It affects all versions prior to 17.11.6, 18.0.4, and 18.1.2. GitLab states that this flaw lets attackers execute actions for users by injecting harmful content, potentially compromising sessions, altering project data, or enabling phishing attacks.
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
CVE-2025-3396 is a flaw in GitLab CE/EE versions from 13.3 to 17.11.6, 18.0 to 18.0.4, and 18.1 to 18.1.2 that involves improper authorization. It has a CVSS score of 4.3 and lets authenticated project owners bypass forking restrictions by manipulating the API.
CVE-2025-4972 affects only GitLab EE and has a CVSS score of 2.7. Authenticated users with group invitation rights can bypass admin restrictions through specially crafted API requests. Affected versions are 18.0 prior to 18.0.4 and 18.1 prior to 18.1.2.
The new vulnerability in GitLab EE, CVE-2025-6168, affects versions 18.0 before 18.0.4 and 18.1 before 18.1.2, with a CVSS score of 2.7. It allows maintainers to invite users to restricted groups through special API requests, bypassing admin controls.
GitLab has upgraded its rsync utility to version 3.4.1 to fix vulnerabilities CVE-2024-12084 and CVE-2024-12088. They advise all self-managed GitLab administrators to update to versions 18.1.2, 18.0.4, or 17.11.6 right away.
“We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” GitLab stated in its advisory.
