Skip to main content

Improper Handling of URL Encoding (Hex Encoding)

CVE-2025-11990

Low
3.1/10

Summary

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • LOW
  • NONE

CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

The software does not properly handle when all or part of an input has been URL encoded.

References

Advisory Timeline

  • Published