CVE-2024-0402

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 16.0, < 16.5.8; >= 16.6, < 16.6.6; >= 16.7, < 16.7.4; >= 16.8, < 16.8.1

References

https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/437819Broken Link
https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/437819Broken Link

Timeline

Published: Jan 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-04036.5Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerabl CVE-2024-04049.1A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthoriz CVE-2024-04056.5The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via CVE-2024-04067.8A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpack CVE-2024-04076.5Certain HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to information disclosure, when connections made CVE-2024-04085.5A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When CVE-2024-04097.8A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cu CVE-2024-04107.7An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior CVE-2024-04117.5A vulnerability was found in DeShang DSMall up to 6.1.0. It has been classified as problematic. This affects an unknown part of the file pub CVE-2024-04129.8A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the CVE-2024-04139.8A vulnerability was found in DeShang DSKMS up to 3.1.2. It has been rated as problematic. This issue affects some unknown processing of the CVE-2024-04149.8A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file publi