CVE-2025-0314
Published: 24 January 2025
Summary
CVE-2025-0314 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gitlab Gitlab. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0314 is a cross-site scripting vulnerability (CWE-79) caused by improper rendering of certain file types in GitLab Community Edition and Enterprise Edition. It affects all versions from 17.2 before 17.6.4, from 17.7 before 17.7.3, and from 17.8 before 17.8.1. The flaw carries a CVSS 3.1 score of 8.7 reflecting network attack vector, low complexity, low required privileges, and required user interaction with changed scope and high impact on confidentiality and integrity.
An authenticated attacker with low privileges can supply or reference specially crafted files that trigger the rendering issue, resulting in script execution in the context of other users' sessions. Successful exploitation can lead to theft of sensitive data or unauthorized actions on behalf of victims within the GitLab instance.
The listed references point to the GitLab issue tracker and a HackerOne report that document the affected releases and the availability of fixes in 17.6.4, 17.7.3, and 17.8.1. The associated EPSS score has remained flat at 0.0790 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1599
Vulnerability details
An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS via improper file rendering directly enables exploitation of the public-facing GitLab web app (T1190) and arbitrary JavaScript execution in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses XSS by requiring output filtering prior to rendering file contents in the GitLab interface.
Validates inputs such as file contents before processing or storage to block malicious scripts that could lead to XSS during rendering.
Mandates timely flaw remediation through patching to fixed GitLab versions (17.6.4, 17.7.3, 17.8.1), eliminating the improper rendering vulnerability.