CVE-2025-12506
Gitlab 16.5.0 – 18.11.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NSummary
CVE-2025-12506 is a low-severity Use of Incorrectly-Resolved Name or Reference (CWE-706) vulnerability in Gitlab Gitlab. Its CVSS base score is 3.5 (Low).
Operationally, ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-7 (Software, Firmware, and Information Integrity) and CM-3 (Configuration Change Control) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-210442
Vulnerability Data
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed…
more
in the web interface differed from the content available for download, due to improper handling of Git reference name resolution.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
SI-7 requires integrity verification of software, firmware, and information to detect unauthorized or unexpected changes, directly mitigating the repository content mismatch introduced by improper Git reference handling.
CM-3 enforces configuration change control and approval processes that would catch and prevent the creation of repositories with inconsistent reference resolution behavior.
AC-3 enforces access control decisions that could limit which authenticated users are permitted to create repositories, reducing the attack surface for this reference-resolution flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices directly prevent incorrect name/reference resolution bugs during coding.
Enforced authorization boundaries limit damage from an incorrectly resolved reference.
Logical segmentation and access controls reduce the chance an out-of-sphere resolution succeeds.
Hardened configuration baselines can constrain allowable name-to-resource mappings.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect incorrect name or reference resolution through fuzzing and negative test cases.
Network segmentation and routing policies reduce the chance that a mis-resolved name leads to an unintended external resource.
Segregated networks limit the blast radius when a name or reference resolves outside the intended control sphere.
Secure SDLC practices include design reviews that can catch incorrect name or reference handling before deployment.
Application security requirements can mandate validation of all external references and names used at runtime.
Secure architecture principles discourage reliance on ambient or globally-resolvable names without explicit scoping.