CVE-2025-12575: Server-Side Request Forgery (SSRF) in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user with certain permissions to make unauthorized requests to internal network services through the GitLab server.
Other sources
GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with certain permissions to perform server-side request forgery against internal network services.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-12575?
CVE-2025-12575 is classified as a medium severity Server-Side Request Forgery vulnerability in GitLab EE.
How do I fix CVE-2025-12575?
To fix CVE-2025-12575, upgrade GitLab EE to versions 18.6.6, 18.7.4, or 18.8.4 or later.
Which versions are affected by CVE-2025-12575?
CVE-2025-12575 affects GitLab EE versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4.
Who is impacted by CVE-2025-12575?
Authenticated users with specific permissions on GitLab EE installations are impacted by CVE-2025-12575.
What is Server-Side Request Forgery as related to CVE-2025-12575?
Server-Side Request Forgery in CVE-2025-12575 allows attackers to send unauthorized requests from the server, potentially accessing sensitive data.