CVE-2024-0402: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-26 · updated 2026-06-17
Weakness: CWE-22

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.

Summary

CVE-2024-0402 is a path traversal flaw in GitLab CE/EE that lets an authenticated user write files to arbitrary locations on the GitLab server while creating a workspace. With a CVSS score of 9.9, this can lead to serious compromise of the server's integrity. It affects all versions from 16.0 before 16.6.6, 16.7 before 16.7.4, and 16.8 before 16.8.1. Proof-of-concept exploitation exists but it is not in CISA KEV; EPSS estimates a 3.8% chance of exploitation in 30 days. Upgrade to 16.5.8, 16.6.6, or 16.7.4 (or later fixed releases) as soon as possible.

CVE-2024-0402 هو ثغرة اجتياز مسار (Path Traversal) في GitLab CE/EE تسمح لمستخدم موثّق بكتابة ملفات في مواقع عشوائية على خادم GitLab أثناء إنشاء مساحة عمل. وبدرجة CVSS تبلغ 9.9 فهي تشكّل خطرًا جسيمًا على سلامة الخادم. تؤثر الثغرة في جميع الإصدارات من 16.0 قبل 16.6.6، و16.7 قبل 16.7.4، و16.8 قبل 16.8.1. يوجد إثبات مفهوم للاستغلال لكنها ليست مدرجة في CISA KEV، وتقدّر EPSS احتمال الاستغلال خلال 30 يومًا بنسبة 3.8%. يُنصح بالترقية إلى 16.5.8 أو 16.6.6 أو 16.7.4 أو إصدارات أحدث مصححة في أقرب وقت.

Affected products

GitLab: from 16.0.0 before 16.5.8; from 16.6.0 before 16.6.6; from 16.7.0 before 16.7.4; 16.8.0 — fixed in 16.5.8, 16.6.6, 16.7.4

How to fix

Upgrade to a fixed version: GitLab 16.5.8, 16.6.6, 16.7.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-0402 or the next vulnerability affects your stack