CVE-2025-12506

MediumCVSS 4.3/10Last modified Sep 29, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from the content available for download, due to improper handling of Git reference name resolution.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-706

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 16.5, < 18.11.7; >= 19.0, < 19.0.4; >= 19.1, < 19.1.2

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/578988Broken Link
https://hackerone.com/reports/3351460Permissions Required

Timeline

Published: Jul 8, 2026
Last modified: Sep 29, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-125078.8The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS serv CVE-2025-125088.4When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of a CVE-2025-125098.4On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with ad CVE-2025-125107.2The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.CVE-2025-125114.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM CVE-2025-125124.3The GenerateBlocks plugin for WordPress is vulnerable to information exposure due to missing object-level authorization checks in versions u CVE-2025-125134.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Host CVE-2025-125147.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-ticke CVE-2025-125159.8Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-125169.8Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-125175.3Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .CVE-2025-125185.3beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject