CVE-2020-13355: 
GitLab vulnerability analysis and mitigation

A path traversal vulnerability was discovered in GitLab CE/EE (CVE-2020-13355) affecting all versions from 8.14 onwards. The vulnerability was found in the LFS Upload functionality, allowing attackers to overwrite specific paths on the server. The affected versions include >=8.14, <13.3.9, >=13.4, <13.4.5, >=13.5, <13.5.2 (GitLab Release, CVE Mitre).

The vulnerability is specifically related to the Large File Storage (LFS) Upload functionality in GitLab. It manifests as a path traversal issue that could allow an attacker to manipulate file paths during the upload process. The vulnerability was discovered through GitLab's HackerOne bug bounty program by researcher saltyyolk (GitLab Release).

The vulnerability allows attackers to overwrite certain specific paths on the server through the LFS Upload functionality, potentially compromising the integrity of the server's file system (CVE Mitre).

The vulnerability was reported through GitLab's bug bounty program on HackerOne, indicating it was discovered in a controlled environment. No public exploits or active exploitation in the wild were reported at the time of disclosure (GitLab Release).

GitLab addressed this vulnerability by releasing security updates in versions 13.5.2, 13.4.5, and 13.3.9. Organizations running affected versions are strongly recommended to upgrade to these patched versions immediately (GitLab Release).