Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.9
CVE-2025-1042: GitLab may expose repository files to outsiders
CVE-2025-1042 · published 1 year ago
Summary
GitLab versions up to 17.6.5, 17.7.4, and 17.8.2 can let anyone view repository contents without permission. This could reveal private code or data to unauthorized users. Update GitLab to the latest release to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab |
>= 15.7.0, < 17.6.5 >= 17.7.0, < 17.7.4 >= 17.8.0, < 17.8.2 cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
Original advisory text
Files or Directories Accessible to External Parties in GitLab
An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/50849943 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1042.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-1042 Vendor Advisory
- https://hackerone.com/reports/2886976 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.9
Medium
Type
CWE-552Files or Directories Accessible to External Parties
Timeline
Published12 Feb 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta