GitLab
GitLab Security Releases - September 2025
gitlab-2025-09 Sep 1, 2025 Source: Vendor
GitLab security advisories for September 2025: 11 CVEs, 7 credited researchers.
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
11 lines
Showing 1–11 of 11
CVE-2025-10094
BR2025-0000-031923
unclaimed
Denial of Service issue in token listing operations impacts GitLab CE/EE
Credited as pwnie
CVE-2025-1250
BR2025-0000-031924
unclaimed
Denial of Service issue in User-Controllable Fields impacts GitLab CE/EE
Credited as pwnie
CVE-2025-2256
BR2025-0000-031925
unclaimed
Denial of Service issue in SAML Responses impacts GitLab CE/EE
Credited as yuki_osaki
CVE-2025-5069
BR2025-0000-031926
unclaimed
Incorrect ownership assignment via Move Issue drop-down impacts GitLab CE/EE
Credited as foxribeye
CVE-2025-6454
BR2025-0000-031927
unclaimed
Server-Side Request Forgery issue in Webhook custom header impacts GitLab CE/EE
Credited as ppee
CVE-2025-6769
BR2025-0000-031928
unclaimed
Information disclosure issue in runner endpoints impacts GitLab CE/EE
Credited as iamgk808
CVE-2025-7337
BR2025-0000-031929
unclaimed
Denial of Service issue in endpoint file upload impacts GitLab CE/EE
Credited as pwnie
CVE-2025-7691
BR2025-0000-031930
unclaimed
Privilege Escalation issue from within the Developer role impacts GitLab EE
Credited as rogerace
CVE-2025-8014
BR2025-0000-031931
unclaimed
Denial of Service issue bypassing query complexity limits impacts GitLab CE/EE
Credited as foxribeye
CVE-2025-9642
BR2025-0000-031932
unclaimed
Cross-site scripting issue in Script Gadgets impacts GitLab CE/EE
Credited as joaxcar
CVE-2025-9958
BR2025-0000-031933
unclaimed
Information disclosure issue in virtual registry configuration for low privileged users impacts GitLab CE/EE
Credited as joaxcar