{"id":"CVE-2025-12073","published":"2026-02-11T11:34:46Z","modified":"2026-02-11T15:14:53Z","title":"Server-Side Request Forgery (SSRF) in GitLab","vendor":"GitLab","product":"GitLab","tier":"tail","description":{"text":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery against internal services by bypassing protections in the Git repository import functionality.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00265,"percentile":0.18364,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/578091","tags":["issue-tracking","permissions-required"]},{"url":"https://hackerone.com/reports/3314987","tags":["technical-description","exploit","permissions-required"]},{"url":"https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/","tags":[]}],"priority":{"score":11.7,"factors":[{"name":"EPSS percentile","points":3.67},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"gitlab","affectedVersions":[{"vendor":"GitLab","product":"GitLab","versions":[">= 18.0, < 18.6.6",">= 18.7, < 18.7.4",">= 18.8, < 18.8.4"]}],"euvd":{"id":"EUVD-2025-207422","exploited":false,"provenance":"source"},"exploitRefs":["https://hackerone.com/reports/3314987"],"lineage":{"familyId":"fam-class-gitlab-gitlab-cwe-918"}}