CVE-2025-9958: Information disclosure issue in virtual registry configuration for low privileged users impacts GitLab CE/EE
An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.
Other sources
GitLab has remediated an issue that could have allowed low privileged users access to sensitive information stored in virtual registry configurations.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.2.7Fixed in 18.3.3Fixed in 18.4.1 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.2.7 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.3.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.4.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-9958?
CVE-2025-9958 is considered a high-severity vulnerability as it allows Guest users to access sensitive information.
How do I fix CVE-2025-9958?
To fix CVE-2025-9958, upgrade your GitLab CE/EE installation to version 18.2.7, 18.3.3, or 18.4.1 or newer.
Who is affected by CVE-2025-9958?
CVE-2025-9958 affects all users of GitLab CE/EE versions from 14.10 up to but not including 18.2.7, 18.3 up to but not including 18.3.3, and 18.4 up to but not including 18.4.1.
What type of information can Guest users access due to CVE-2025-9958?
Due to CVE-2025-9958, Guest users could potentially access sensitive information stored in virtual registry configurations.
Is there a workaround for CVE-2025-9958?
There is no recommended workaround for CVE-2025-9958; upgrading to a patched version is the only solution.