CVE-2025-0194: Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-0194?
CVE-2025-0194 is classified as a high severity vulnerability due to the potential exposure of access tokens.
How do I fix CVE-2025-0194?
To fix CVE-2025-0194, upgrade GitLab to versions 17.5.5 or 17.6.3, or 17.7.1 or later.
Who is affected by CVE-2025-0194?
CVE-2025-0194 affects all versions of GitLab CE/EE starting from 17.4 to 17.5.5, 17.6 to 17.6.3, and 17.7 to 17.7.1.
What are the risks associated with CVE-2025-0194?
The risks associated with CVE-2025-0194 include unauthorized access due to exposed access tokens in logs.
When was CVE-2025-0194 disclosed?
CVE-2025-0194 was disclosed in January 2025, with a patch released shortly thereafter.