CVE-2025-6454CWE-918ssrf

CVE-2025-6454

High · published September 12, 2025

CVSS v3.1
8.5
EPSS
1%
Percentile
53.8
In the wild
Unconfirmed
What it is

An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00733 · 53.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-09-12T10:15Z
Affected products (6)
ProductVersionsFixed in
gitlab/gitlab≥ 16.11.0, < 18.1.618.1.6
gitlab/gitlab≥ 16.11.0, < 18.1.618.1.6
gitlab/gitlab≥ 18.2.0, < 18.2.618.2.6
gitlab/gitlab≥ 18.2.0, < 18.2.618.2.6
gitlab/gitlab≥ 18.3.0, < 18.3.218.3.2
gitlab/gitlab≥ 18.3.0, < 18.3.218.3.2
References (3)
https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/ · [email protected]https://gitlab.com/gitlab-org/gitlab/-/issues/550766 · [email protected]https://hackerone.com/reports/3162711 · [email protected]
EPSS history
Timeline
  • 12 SEP 06:05Z
    Server-Side Request Forgery (SSRF) in GitLab
    cvelistv5