Apply the latest GitLab patches immediately. For self-hosted instances, update to the patched version as specified in the GitLab security advisory. For GitLab.com, ensure the instance is up to date with the latest platform updates. Review file access permissions and restrict access to sensitive directories as a defense-in-depth measure.
Quick answers
What is CVE-2023-2825?
Apply the latest GitLab patches immediately. For self-hosted instances, update to the patched version as specified in the GitLab security advisory. For GitLab.com, ensure the instance is up to date with the latest platform updates. Review file access permissions and restrict access to sensitive directories as a defense-in-depth measure.
How severe is CVE-2023-2825?
critical, CVSS 9.8
Is CVE-2023-2825 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2023-2825 be mitigated?
Apply the latest GitLab patches immediately. For self-hosted instances, update to the patched version as specified in the GitLab security advisory. For GitLab.com, ensure the instance is up to date with the latest platform updates. Review file access permissions and restrict access to sensitive directories as a defense-in-depth measure.
CVSS
9.8
Vendor
GitLab
Published
Sep 30, 2026 · 08:05
Patch
Unknown / not confirmed
Affected products
GitLab
Mitigation
Apply the latest GitLab patches immediately. For self-hosted instances, update to the patched version as specified in the GitLab security advisory. For GitLab.com, ensure the instance is up to date with the latest platform updates. Review file access permissions and restrict access to sensitive directories as a defense-in-depth measure.
GitLab has released security updates to address a critical path traversal vulnerability (CVE-2023-2825) that could allow unauthorized access to sensitive files on self-hosted instances. Users are strongly advised to apply the available patches immediately.
