CVE-2025-9958: 
GitLab vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2025-9958) was discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. The vulnerability could allow Guest users to access sensitive information stored in virtual registry configurations (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data). The vulnerability specifically affects the virtual registry configuration component of GitLab, where low-privileged users could gain unauthorized access to sensitive information (GitLab Release).

The vulnerability allows Guest users, who typically have limited access privileges, to view sensitive information stored in virtual registry configurations. This could potentially lead to the exposure of confidential configuration data that should only be accessible to users with higher privilege levels (GitLab Release).

GitLab has released patches in versions 18.4.1, 18.3.3, and 18.2.7 to address this vulnerability. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take any action (GitLab Release).