CVE-2023-2825

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS

71.64% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-22

Published

2023-05-26

Updated

2025-01-15

Proof-of-concept exploits (8)

• EmmanuelCruzL/CVE-2023-28250★ · 2023-06-17
• Occamsec/CVE-2023-2825140★ · 2023-06-02
• Rubikcuv5/CVE-2023-28250★ · 2023-06-17
• Tornad0007/CVE-2023-2825-Gitlab0★ · 2023-05-30
• alej6/MassCyberCenter-Mentorship-Project-0★ · 2025-01-08
• caopengyan/CVE-2023-28250★ · 2023-09-10
• cc3305/CVE-2023-28250★ · 2024-07-27
• Groppoxx/CVE-2023-2825-PoC

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2825.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gitlab_authenticated_sub…

References

• CVE Record
• NVD entry

Related

• CVE-2018-10933
• CVE-2023-25157
• CVE-2023-30253
• CVE-2024-25600
• CVE-2023-3450
• CVE-2021-22204