CVE-2025-9958 — Sensitive Info Insertion into Sent Data in Gitlab

CWE-201 — Sensitive Info Insertion into Sent Data4 documents4 sources
Severity
7.7HIGHNVD
EPSS
0.0%
top 99.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedSep 26

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 3.1 | Impact: 4.0

Affected Packages5 packages

▶CVEListV5gitlab/gitlab14.10 — 18.2.7+2
▶NVDgitlab/gitlab14.10.0 — 18.2.7+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-mq5h-8f38-3xwp: An issue has been discovered in GitLab CE/EE affecting all versions from 14↗2025-09-26
▶

📋Vendor Advisories

2
GitLab
CVE-2025-9958: An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could h↗2025-09-26
▶
Debian
CVE-2025-9958: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 b...↗2025
▶