CVE-2025-12716: 
GitLab vulnerability analysis and mitigation

CVE-2025-12716 is a stored cross-site scripting (XSS) vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content. It affects all GitLab CE/EE versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2. The vulnerability was disclosed on December 10–11, 2025, and was reported through GitLab's HackerOne bug bounty program by researcher yvvdwf. It carries a CVSS v3.1 base score of 8.7 (High) (GitLab Advisory, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. An authenticated attacker with low privileges can craft a wiki page containing malicious JavaScript or HTML content that, when viewed by another user, executes in that user's browser context. The attack vector is network-based, requires low privileges, and necessitates user interaction (a victim viewing the malicious wiki page), but the scope is changed — meaning the impact extends beyond the vulnerable component itself. The issue was tracked internally at GitLab issue #579548 and HackerOne report #3405832 (GitLab Advisory).

Successful exploitation can result in high confidentiality and integrity impact with a changed scope, meaning an attacker can compromise resources beyond the GitLab wiki component itself. A low-privileged attacker could hijack victim user sessions, perform unauthorized actions impersonating another user (including administrators), access sensitive project data, or manipulate repository settings and CI/CD pipelines. Availability is not directly impacted by this vulnerability (GitLab Advisory, Red Hat CVE).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.019% (0.000190), indicating a low probability of exploitation in the near term. The vulnerability requires an authenticated attacker with at least guest-level access and a victim to interact with the malicious wiki page, which somewhat limits opportunistic exploitation.

1. Reconnaissance: Identify a target GitLab CE/EE instance running versions 18.4.0–18.4.5, 18.5.0–18.5.3, or 18.6.0–18.6.1 using version disclosure endpoints (e.g., /api/v4/version if accessible) or public GitLab instance directories.
2. Obtain low-privilege access: Register or use an existing authenticated account with at least guest or reporter access to a project that has wiki functionality enabled.
3. Create malicious wiki page: Navigate to the project's wiki and create or edit a page, injecting a malicious XSS payload into the wiki content (e.g., a crafted Markdown or HTML block that embeds JavaScript to steal session cookies or perform actions via the GitLab API on behalf of the victim).
4. Deliver the link: Share the URL of the malicious wiki page with a higher-privileged user (e.g., project maintainer or owner) via an issue comment, email, or other social engineering vector.
5. Trigger execution: When the victim visits the wiki page, the injected script executes in their browser context, potentially exfiltrating their session token, performing API calls as the victim, or modifying project settings.
6. Achieve objective: Use the hijacked session or performed actions to escalate privileges, access private repositories, modify CI/CD pipelines, or exfiltrate sensitive data (GitLab Advisory).

• Network: Unusual outbound HTTP requests from a victim's browser to attacker-controlled domains originating from GitLab wiki page views; unexpected API calls (e.g., POST /api/v4/projects/:id/members, PUT /api/v4/projects/:id) made with a legitimate user's session token from unfamiliar IP addresses.
• Logs: GitLab application logs showing wiki page creation or edits by low-privilege users containing suspicious HTML/JavaScript patterns; access logs recording wiki page views followed immediately by API calls from the same session to sensitive endpoints.
• File System: Newly created or recently modified wiki pages in the GitLab repository containing <script>, javascript:, onerror=, or similar XSS payload indicators in their raw content.
• User Activity: Unexpected privilege escalations, project membership changes, or CI/CD pipeline modifications attributed to a user who did not initiate them; user accounts performing actions inconsistent with their role or typical behavior.

GitLab has released patched versions on December 10, 2025: 18.4.6, 18.5.4, and 18.6.2 for both CE and EE. GitLab.com and GitLab Dedicated instances were patched automatically and require no action. All self-managed GitLab installations should upgrade to one of these versions immediately. As a temporary workaround, administrators can restrict wiki page creation permissions to trusted users only, and implement strict content security policies. Monitoring for suspicious wiki page creations and reviewing user access controls is also recommended (GitLab Advisory).

The vulnerability received coverage from multiple security news outlets including SecurityOnline, CyberSecurityNews, Heise, and eSecurity Planet, which highlighted the risk of session hijacking via malicious wiki pages (SecurityOnline, CyberSecurityNews). The Belgian Centre for Cybersecurity (CCB) issued an advisory warning about the high-severity vulnerabilities in GitLab CE/EE. The vulnerability was also included in The Hacker News weekly recap and noted by CISA in its weekly vulnerability bulletin (SB25-349). Community discussion on Bluesky and security aggregators reflected moderate concern, consistent with the high CVSS score and the potential for account takeover in shared GitLab environments.