CVE-2020-26405: 
GitLab vulnerability analysis and mitigation

A path traversal vulnerability (CVE-2020-26405) was discovered in GitLab CE/EE's package upload functionality, affecting versions from 12.8 onwards. The vulnerability allows attackers to save packages in arbitrary locations on the system. The affected versions include GitLab installations >=12.8 and <13.3.9, >=13.4 and <13.4.5, and >=13.5 and <13.5.2. This security issue was identified and reported through GitLab's HackerOne bug bounty program (GitLab Release).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) with a CVSS v3.1 Base Score of 7.1 (High). The technical issue stems from insufficient path validation in the package upload functionality, where the package_filename is updated with values directly from the metadata without proper security checks. This allows for directory traversal, potentially enabling attackers to write controlled data with the .nupkg extension to any location accessible by the git user (NVD).

The vulnerability allows attackers to save packages with the .nupkg extension in arbitrary locations on the server where the git user has access. Parent directories are automatically created during this process, and while files must maintain the .nupkg extension, attackers could potentially use polyglot files to include arbitrary data. This could lead to security implications depending on the locations accessible to the git user (GitLab Issue).

The vulnerability can be exploited by creating a specially crafted nuspec file with path traversal sequences and uploading it via the GitLab API. The attack requires valid authentication with sufficient privileges to upload packages. The exploitation process involves manipulating the package metadata to specify arbitrary file locations on the system (GitLab Issue).

GitLab has addressed this vulnerability in versions 13.3.9, 13.4.5, and 13.5.2. Organizations running affected versions are strongly recommended to upgrade to these patched versions immediately. The fix implements proper validation of package_filename values before processing them (GitLab Release).