CVE-2023-2825

Name of the Vulnerable Software and Affected Versions GitLab versions 16.0.0

Description The issue is related to a path traversal vulnerability that allows an unauthenticated malicious user to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups. This vulnerability can be exploited by a remote attacker to gain unauthorized access to protected information. The vulnerability is caused by incorrect restriction of the path name to a directory with limited access.

Recommendations For GitLab version 16.0.0, update to version 16.0.1 to resolve the issue. As a temporary workaround, consider restricting access to public projects with attachments nested within at least five groups until the update is applied. Avoid using attachments in public projects until the issue is resolved.