CVE-2025-0811: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. The vulnerability involves improper rendering of certain file types that leads to cross-site scripting. This security flaw was reported through GitLab's HackerOne bug bounty program by researcher yvvdwf (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 base score of 8.7 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) (NVD Database).

This high-severity cross-site scripting vulnerability could potentially allow attackers to execute malicious scripts in the context of other users' browsers, leading to the potential compromise of confidential information and user sessions (GitLab Release).

GitLab has released patches in versions 17.8.6, 17.9.3, and 17.10.1 to address this vulnerability. GitLab.com is already running the patched version, and all self-managed GitLab installations are strongly recommended to upgrade to one of these versions immediately. GitLab Dedicated customers do not need to take any action (GitLab Release).