CVE-2026-5816
Gitlab 18.10.0 – 18.10.4
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:NSummary
CVE-2026-5816 is a high-severity Improper Resolution of Path Equivalence (CWE-41) vulnerability in Gitlab Gitlab. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-5816 is a vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that stems from improper path validation, enabling an unauthenticated user to execute arbitrary JavaScript in a victim's browser session under certain conditions. It affects all versions from 18.10 prior to 18.10.4 and 18.11 prior to 18.11.1. The issue has a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) and is associated with CWE-41 (Improper Resolution of Path Equivalence).
An unauthenticated attacker with network access can exploit this vulnerability by tricking a user into interacting with a maliciously crafted request or resource that bypasses path validation checks. Exploitation requires high attack complexity and user interaction, but successful execution allows the attacker to achieve high-impact confidentiality and integrity violations within the changed scope of the victim's browser session, such as stealing session cookies, data, or performing actions on behalf of the user.
GitLab has remediated the issue with patch releases, including GitLab 18.11.1 and 18.10.4, as detailed in their release notes. Additional information is available in the associated GitLab work item (gitlab.com/gitlab-org/gitlab/-/work_items/592816) and the originating HackerOne disclosure report (hackerone.com/reports/3572231). Security practitioners should prioritize upgrading affected instances to patched versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25046
Vulnerability Data
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation…
more
under certain conditions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation of file paths directly rejects or normalizes the special-character manipulations that create equivalent names.
Proper enforcement of file access authorizations structurally blocks disclosure when equivalent paths are presented.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards directly require canonical path resolution and input sanitization to prevent equivalence attacks.
Security testing can detect path-equivalence flaws before release, partially fulfilling the control.
Secure development lifecycle includes path-handling requirements that reduce equivalence-based disclosure.
Application security requirements can mandate canonicalization and input validation to block path equivalence.
Secure architecture principles call for safe file-system abstractions that mitigate path traversal risks.
Information access restriction limits what files can be reached, indirectly reducing impact of path-equivalence exploits.