Security1 publisher2 min readPublished
GitLab's 19.3.2 release closes an unauthenticated arbitrary file read in the commits API
GitLab shipped 19.3.2, 19.2.6 and 19.1 to fix a maximum-severity path traversal that needs no account, plus an Enterprise Edition deserialization bug that needs a Duo Chat user. GitLab.com is already patched.
The Watch · Security desk
What happened
- GitLab told self-managed users on Thursday to patch immediately against a maximum-severity path traversal in the repository commits API, tracked in the report as CVE-2023-2825.
- Both issues are fixed in Community Edition and Enterprise Edition 19.3.2, 19.2.6 and 19.1, released Thursday.
- CISA has flagged four GitLab vulnerabilities as exploited in attacks since November 2021, two of them added this February.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure A file read on a code host reaches whatever the process can open on disk; when GitLab fixed a comparable path traversal in May 2023 it described the exposure as proprietary source, user credentials, tokens and files.
- decision GitLab's published remedy is a version, so the choice in front of operators is when to take the restart.
- constraint Only self-managed estates own this work; GitLab.com and Dedicated customers have nothing to schedule. Fewer operators have to find a window.
- contradiction The report gives Thursday's path traversal the same CVE number it gives a May 2023 flaw, so anyone verifying the fix by identifier alone can match the wrong advisory.
The bug is improper path confinement and missing authentication enforcement in the repository commits API [2]. GitLab says unauthenticated attackers can read arbitrary files from a vulnerable server "under certain conditions" [4]. The qualifier is GitLab's; the conditions are not spelled out in the advisory as reported. The report came through HackerOne from a researcher using the handle s3ntago [3].
The second critical bug is a different problem. CVE-2026-87719 is an insecure deserialization in the GraphQL subscription serializer [5]. It affects Enterprise Edition, and it needs an authenticated user with Duo Chat access, who can then steal sensitive credentials and Advanced Search instance configurations [6]. Of the two criticals in this release, one is reachable with no account at all [17].
Both fixes ship in Community Edition and Enterprise Edition 19.3.2, 19.2.6 and 19.1 [7]. "These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately," GitLab said [8]. "GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action," the company added [9]. Note the version list as published: 19.3.2 and 19.2.6 carry a patch component and 19.1 does not [16]. Operators pinned on a 19.1.x point release should confirm the exact target before they roll.
The exploitation record is worth weighing. CISA has flagged four GitLab vulnerabilities as exploited in attacks since November 2021, two of them, CVE-2021-22175 and CVE-2021-39935, added in February this year [13]. That is half the list arriving in a single month [15]. In January GitLab patched a high-severity two-factor authentication bypass in both editions that let an attacker who knows the target's account ID skip 2FA [12]. In May 2023 it fixed a maximum-severity path traversal that exposed proprietary software code, user credentials, tokens and files on unpatched servers [10]. A year after that, CISA and the FBI told software vendors to remove path traversal flaws before shipping, saying such flaws "have been called 'unforgivable' since at least 2007" [11].
One caution on identifiers. BleepingComputer's report gives Thursday's path traversal the number CVE-2023-2825 [1] and gives the May 2023 path traversal the same number [10]. It also dates the deserialization patch to the day before while saying both issues were fixed in the Thursday releases [5][7]. The version numbers, at least, map cleanly onto a change ticket.
GitLab has more than 30 million registered users, and more than half of the Fortune 100 run it [14].
What to watch
- Whether CISA adds either CVE to its exploited vulnerabilities catalog, which would attach a federal remediation date to the upgrade.
- Whether GitLab publishes affected version ranges below 19.1 and a corrected identifier for the commits API path traversal.
- Whether scanning or exploitation shows up against internet-facing self-managed instances, given the file read needs no authentication.