CVE-2025-12716: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content.
Other sources
GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-12716?
CVE-2025-12716 is considered a high severity vulnerability due to its potential for unauthorized actions on behalf of other users.
How do I fix CVE-2025-12716?
To mitigate CVE-2025-12716, upgrade to GitLab versions 18.4.6, 18.5.4, or 18.6.2.
Who is affected by CVE-2025-12716?
CVE-2025-12716 affects authenticated users of GitLab versions prior to the security updates.
What kind of actions can be performed by exploiting CVE-2025-12716?
Exploiting CVE-2025-12716 allows an authenticated user to perform unauthorized actions by creating malicious wiki pages.
Is there a patch available for CVE-2025-12716?
Yes, patches for CVE-2025-12716 are available in the updated versions of GitLab.