{"id":"CVE-2023-2825","published":"2023-05-26T00:00:00Z","modified":"2025-01-15T15:45:18Z","title":"An issue has been discovered in GitLab CE/EE affecting only version 16.0.0","vendor":"GitLab","product":"GitLab","tier":"core","eol":null,"affectedVersions":[{"vendor":"GitLab","product":"GitLab","versions":["16.0.0"]}],"description":{"text":"An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.","provenance":"source","from":"CVE.org"},"summary":{"text":"A path traversal flaw in GitLab CE/EE version 16.0.0 lets a malicious user read arbitrary files on the server. An unauthenticated attacker can exploit it over the network without user interaction, but only when an attachment exists in a public project nested within at least five groups.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:34Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.71641,"percentile":0.99418,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-02","exploitedFirstSeen":"2026-08-02","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-02&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-02"},{"url":"https://previdian.com/CVE-2023-2825","date":"2026-08-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-03&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-04&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-06&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-07&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-13&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-16&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-21&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-21&host_type=src&vulnerability=cve-2023-2825","date":"2026-09-21"}],"evidenceTotal":13,"provenance":"source"},"exploited":true,"otx":{"pulseCount":9,"pulses":[{"name":"GitLab AI Gateway Critical RCE CVE-2026-90970 (Self-Hosted Duo)","url":"https://otx.alienvault.com/pulse/6ac48f6df43a68b1dcac8ca0","created":"2026-10-06"},{"name":"Dell CSM Max-Severity K8s Auth Bypass & Cluster Compromise (CVE-2026-63688 et al.)","url":"https://otx.alienvault.com/pulse/6ac09adb4e8eb29d6249d407","created":"2026-10-03"},{"name":"CVE-2026-85706 GitLab Unauth File Read Actively Exploited (CISA KEV)","url":"https://otx.alienvault.com/pulse/6aa8e00c3c7ff7cd358e6fb5","created":"2026-09-15"},{"name":"GitLab Critical Path Traversal CVE-2026-85706 + EE Deserialization CVE-2026-87719","url":"https://otx.alienvault.com/pulse/6aa4eb59ab99fcee058bfe50","created":"2026-09-12"},{"name":"DreamBus Botnet Exploiting execution Flaw in RocketMQ servers","url":"https://otx.alienvault.com/pulse/64f02611de531ca0647eefc7","created":"2023-08-31"},{"name":"DreamBus Botnet Exploiting execution Flaw in RocketMQ servers","url":"https://otx.alienvault.com/pulse/64f0118efb915d7bc05af124","created":"2023-08-31"},{"name":"DreamBus Botnet Exploiting execution Flaw in RocketMQ servers","url":"https://otx.alienvault.com/pulse/64ee0767ef32a83bd953ff02","created":"2023-08-29"},{"name":"DreamBus Botnet Resurfaces, Targets RocketMQ vulnerability | Official Juniper Networks Blogs","url":"https://otx.alienvault.com/pulse/64edce380fea5b4bd8e9d07b","created":"2023-08-29"},{"name":"DreamBus Botnet Exploiting execution Flaw in RocketMQ servers","url":"https://otx.alienvault.com/pulse/64edc1c1da86d242ddd791dc","created":"2023-08-29"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/412371","tags":[]},{"url":"https://hackerone.com/reports/1994725","tags":[]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2825.json","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-34276","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-34276","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2023-05-25","earliestUrl":"https://github.com/Occamsec/CVE-2023-2825","repos":[{"name":"Occamsec/CVE-2023-2825","url":"https://github.com/Occamsec/CVE-2023-2825","stars":139,"created":"2023-05-25"},{"name":"Groppoxx/CVE-2023-2825-PoC","url":"https://github.com/Groppoxx/CVE-2023-2825-PoC","stars":4,"created":"2026-05-17"},{"name":"Tornad0007/CVE-2023-2825-Gitlab","url":"https://github.com/Tornad0007/CVE-2023-2825-Gitlab","stars":0,"created":"2023-05-30"},{"name":"Rubikcuv5/CVE-2023-2825","url":"https://github.com/Rubikcuv5/CVE-2023-2825","stars":0,"created":"2023-06-05"},{"name":"cc3305/CVE-2023-2825","url":"https://github.com/cc3305/CVE-2023-2825","stars":0,"created":"2024-06-20"}]},"metasploit":[{"name":"GitLab Authenticated File Read","module":"auxiliary/gather/gitlab_authenticated_subgroups_file_read","type":"auxiliary","disclosureDate":"2023-05-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb"}],"nuclei":[{"id":"CVE-2023-2825","name":"GitLab 16.0.0 - Path Traversal","severity":"high","path":"http/cves/2023/CVE-2023-2825.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2825.yaml"}],"first":{"date":"2023-05-23","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-05-23","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-05-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb","provenance":"source"},{"date":"2023-05-26","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-2825","provenance":"source"},{"date":"2026-08-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-02&host_type=src&vulnerability=cve-2023-2825","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":79.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 88 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9942"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}