GitLab
GitLab Patch Release: 18.5.2, 18.4.4, 18.3.6
patch-release-gitlab-18-5-2-released Nov 12, 2025 Source: Vendor
Imported by the GitLab patch release catcher from https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-5-2-released/. 9 CVE sections listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-5-2-released/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
8 lines
Showing 1–8 of 8
CVE-2025-11224
BR2025-0000-009606
unclaimed
Cross-site scripting issue in k8s proxy impacts GitLab CE/EE
Credited as joaxcar
CVE-2025-2615
BR2025-0000-009607
unclaimed
Information Disclosure issue in GraphQL subscriptions impacts GitLab CE/EE
Credited as rogerace
CVE-2025-7000
BR2025-0000-009608
unclaimed
Information Disclosure issue in access control impacts GitLab CE/EE
Credited as weasterhacker
CVE-2025-6945
BR2025-0000-009609
unclaimed
Prompt Injection issue in GitLab Duo review impacts GitLab EE
Credited as rogerace
CVE-2025-11990
BR2025-0000-009610
unclaimed
Client Side Path Traversal issue in branch names impacts GitLab EE
Credited as swiftee
CVE-2025-6171
BR2025-0000-009611
unclaimed
Information Disclosure issue in packages API endpoint impacts GitLab CE/EE
Credited as iamgk808
CVE-2025-7736
BR2025-0000-009612
unclaimed
Improper Access Control issue in GitLab Pages impacts GitLab CE/EE
Credited as mateuszek
CVE-2025-12983
BR2025-0000-009613
unclaimed
Denial of service issue in markdown impacts GitLab CE/EE
Credited as phli