What’s Vulnerable › Vulnerabilities
CVE-2024-8647: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-12-12 · updated 2026-06-17
- Weakness: CWE-22
Description
An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled.
Affected products
- GitLab: from 15.2.0 before 17.4.6; from 17.5.0 before 17.5.4; from 17.6.0 before 17.6.2 — fixed in 17.4.6, 17.5.4, 17.6.2
How to fix
Upgrade to a fixed version: GitLab 17.4.6, 17.5.4, 17.6.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-8647 or the next vulnerability affects your stack