CVE-2025-0314

CVE-2025-0314 is a cross-site scripting (XSS) vulnerability, classified as CWE-79, discovered in GitLab Community Edition (CE) and Enterprise Edition (EE). It affects all versions from 17.2 prior to 17.6.4, 17.7 prior to 17.7.3, and 17.8 prior to 17.8.1. The root cause is improper rendering of certain file types, which enables XSS attacks within the GitLab interface.

With a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the vulnerability can be exploited over the network by an attacker possessing low privileges, such as a regular authenticated user. Exploitation requires low complexity but user interaction, typically by tricking a victim into viewing or interacting with a malicious file in GitLab. Success grants high confidentiality and integrity impacts across the changed scope, allowing potential theft of session data, cookies, or execution of arbitrary scripts in the victim's browser context.

Advisories indicate mitigation through upgrading to patched versions: 17.6.4, 17.7.3, or 17.8.1 and later. Additional details are available in the GitLab issue tracker at https://gitlab.com/gitlab-org/gitlab/-/issues/512118 and the originating HackerOne report at https://hackerone.com/reports/2922313.