CVE-2020-26405: Path Traversal
Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26405?
CVE-2020-26405 has a moderate severity level as it allows unauthorized file storage in arbitrary locations.
How do I fix CVE-2020-26405?
To remediate CVE-2020-26405, upgrade GitLab to versions 13.3.9 or later, or 13.4.5 or later, or 13.5.2 or later.
What versions are affected by CVE-2020-26405?
CVE-2020-26405 affects GitLab versions from 12.8 to 13.3.9 and includes various versions of 13.4 and 13.5.
What is a path traversal vulnerability in CVE-2020-26405?
A path traversal vulnerability in CVE-2020-26405 allows an attacker to manipulate file paths to store files outside intended directories.
Is CVE-2020-26405 present in both Community and Enterprise editions of GitLab?
Yes, CVE-2020-26405 affects both GitLab Community Edition and GitLab Enterprise Edition.