CVE-2026-3855
Received
Received - Intake
Authenticated File Access in GitLab CE/EE via Terraform State Upload
Vulnerability report for CVE-2026-3855, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-16
Last updated on: 2026-09-16
Assigner: GitLab Inc.
Description
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cause denial of service due to improper validation of parameters in the Terraform state upload functionality.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab_ce | From 18.2.7 (inc) to 19.1.8 (exc) |
| gitlab | gitlab_ee | From 18.2.7 (inc) to 19.1.8 (exc) |
| gitlab | gitlab_ce | From 19.2 (inc) to 19.2.6 (exc) |
| gitlab | gitlab_ee | From 19.2 (inc) to 19.2.6 (exc) |
| gitlab | gitlab_ce | From 19.3 (inc) to 19.3.2 (exc) |
| gitlab | gitlab_ee | From 19.3 (inc) to 19.3.2 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-99 | The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. |
