CVE-2025-0314: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0314?
CVE-2025-0314 has been rated as a medium severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2025-0314?
To fix CVE-2025-0314, upgrade your GitLab CE/EE to versions 17.6.4, 17.7.3, or 17.8.1 or later.
What software versions are affected by CVE-2025-0314?
CVE-2025-0314 affects GitLab CE/EE versions from 17.2 up to but not including 17.6.4, 17.7 up to but not including 17.7.3, and 17.8 up to but not including 17.8.1.
What type of vulnerability is CVE-2025-0314?
CVE-2025-0314 is a cross-site scripting (XSS) vulnerability caused by improper rendering of certain file types.
Can CVE-2025-0314 be exploited remotely?
Yes, CVE-2025-0314 can be exploited remotely, enabling an attacker to execute malicious scripts in the context of a user's session.