GitLab Critical Path Traversal Vulnerability CVE-2025-13761 Enables RCE

A critical path traversal vulnerability, identified as CVE-2025-13761, has been discovered in the GitLab API, specifically within the Commits API. Attacking via a single HTTP request, threat actors can bypass file system restrictions to perform arbitrary file reads. This vulnerability allows for the unauthorized extraction of sensitive data, including /etc/passwd, SSH keys, and application secrets, which facilitates privilege escalation to Remote Code Execution (RCE). With a CVSS score of 10.0, the flaw is currently subject to active exploitation and widespread automated scanning. Immediate upgrade to GitLab version 19.3.2 or later is required to prevent full server compromise.

• Vulnerability Mechanics: Path Traversal via API

  • Exploitation leverages a flaw in the GitLab Commits API to bypass directory restrictions.
  • The attack vector requires only a single HTTP request to achieve unauthorized file system access.
  • Targeted components include the GitLab server-side file system via specific API endpoints.

• Impact Analysis: Full System Compromise

  • Criticality is rated at CVSS 10.0 due to the extreme ease of exploitation and high impact.
  • Potential payload targets include configuration files, environment variables, and highly sensitive application secrets.
  • Successful arbitrary file reads enable attackers to escalate privileges to full Remote Code Execution (RCE).

• Threat Landscape: Active Exploitation

  • Reports indicate active exploitation began within hours of the vulnerability's identification.
  • Rapidly increasing automated scanning patterns are being observed across the public internet.
  • The short discovery-to-exploitation window significantly increases the risk for unpatched instances.

• Remediation and Defense

  • Urgent deployment of GitLab Patch Release 19.3.2 or later is the primary remediation requirement.
  • Organizations should monitor API logs for unusual path traversal patterns or unauthorized access to sensitive system files.
  • Prioritize patching all GitLab instances, specifically those facing the public internet.