GitLab Critical Path Traversal Vulnerability CVE-2025-13761 Enables RCE
A critical path traversal vulnerability, identified as CVE-2025-13761, has been discovered in the GitLab API, specifically within the Commits API. Attacking via a single HTTP request, threat actors can bypass file system restrictions to perform arbitrary file reads. This vulnerability allows for the unauthorized extraction of sensitive data, including /etc/passwd, SSH keys, and application secrets, which facilitates privilege escalation to Remote Code Execution (RCE). With a CVSS score of 10.0, the flaw is currently subject to active exploitation and widespread automated scanning. Immediate upgrade to GitLab version 19.3.2 or later is required to prevent full server compromise.
GitLab Remediation of Critical RCE and Information Disclosure Vulnerabilities
GitLab released patch 18.10.3 to address a cluster of critical vulnerabilities, including CVE-2026-1606 and CVE-2026-3074, affecting both Community (CE) and Enterprise (EE) editions. These flaws enable Remote Code Execution (RCE) and significant information disclosure, primarily via code injection vectors within the GitLab Snippets feature and unauthenticated API endpoints. Successful exploitation allows attackers to achieve full system takeover, exfiltrate sensitive source code, and access stored credentials. This marks a shift from historical unauthenticated RCEs to more complex injection flaws requiring immediate version upgrades and rigorous auditing of snippet usage patterns to prevent unauthorized system access.
Auditing GitLab: The CI/CD Kill Chain
GitLab CI/CD pipelines have become high-value targets, functioning as force multipliers for attackers to achieve large-scale supply chain compromise. The attack vector typically begins with initial access via credential theft or branch hijacking, progressing to the manipulation of .gitlab-ci.yml files or Runner configurations. This enables privilege escalation through the exfiltration of environment variables, SSH keys, and Personal Access Tokens (PATs), culminating in artifact poisoning. The ultimate impact is the injection of malicious code into production binaries or container images, facilitating downstream ecosystem compromises similar to the SolarWinds incident.