CVE-2025-6171

MediumCVSS 4.3/10Last modified Oct 19, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker with reporter access to view branch names and pipeline details by accessing the packages API endpoint even when repository access was disabled.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 13.2, < 18.3.6; >= 18.4, < 18.4.4; >= 18.5, < 18.5.2

References

https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/549730Broken Link
https://hackerone.com/reports/3183740Permissions Required

Timeline

Published: Nov 15, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-617134.4A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiP CVE-2025-61729.8Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation.CVE-2025-617237.5The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which p CVE-2025-617245.3The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a CVE-2025-617257.5The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-lite CVE-2025-617267.5The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is CVE-2025-617276.5An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a CVE-2025-617286.5archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to CVE-2025-617297.5Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furtherm CVE-2025-61737.2A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the CVE-2025-617305.3During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello a CVE-2025-617317.8Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. T