GitLab CE/EE (versions 18.7–19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2)
GitLab is a web-based platform that teams use to host, review, and collaborate on software code.
Root Cause
The server fails to sanitise file path inputs before processing them, allowing a specially crafted request to escape the intended directory and reach arbitrary files — including credentials and configuration secrets.
Attack Vector
An attacker sends a POST request to /api/v4/projects/{id}/repository/commits/ with a manipulated file.path parameter. No login required. The server returns the requested file's contents directly.
Detection Notes
Search your logs for POST requests to /api/v4/projects/{id}/repository/commits/ URIs that include file.path parameters. Unexpected hits from external IPs are a strong indicator of exploitation.
Recommended Actions
- Upgrade to GitLab 19.1.8, 19.2.6, or 19.3.2 immediately
- If you cannot patch right now, restrict external access to the GitLab API at your firewall
- Review logs for the pattern above and audit recent access to sensitive configuration files