CVE-2025-3950
Unknown
Unknown - Not Provided
BaseFortify
Vulnerability report for CVE-2025-3950, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-01-09
Last updated on: 2026-01-09
Assigner: GitLab Inc.
Description
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed a user to leak certain information by referencing specially crafted images that bypass asset proxy protection.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab_ce | From 10.3 (inc) to 18.5.5 (exc) |
| gitlab | gitlab_ce | From 18.6 (inc) to 18.6.3 (exc) |
| gitlab | gitlab_ce | From 18.7 (inc) to 18.7.1 (exc) |
| gitlab | gitlab_ee | From 10.3 (inc) to 18.5.5 (exc) |
| gitlab | gitlab_ee | From 18.6 (inc) to 18.6.3 (exc) |
| gitlab | gitlab_ee | From 18.7 (inc) to 18.7.1 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-359 | The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. |
