PT-2026-93325

CVE-2026-3855

Published

2026-09-16

Updated

2026-09-25

Description by

CVSS 3.1

6.8

Medium

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2.7 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1

Description An issue exists where an authenticated user with project-level permissions can access restricted file contents on the server or cause a denial of service. This occurs due to improper validation of parameters within the Terraform state upload functionality.

Recommendations Update GitLab CE/EE to version 19.1.8 or later. Update GitLab CE/EE to version 19.2.6 or later. Update GitLab CE/EE to version 19.3.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ahacker1

Vendors

Affected products

Weakness enumeration

CWE-99: Improper Control of Resource Identifiers (\'Resource Injection\')

Related identifiers

CVE-2026-3855