GitLab urges users to update after patching high-risk flaws affecting repositories and services

GitLab has released new patch updates addressing multiple high-severity security vulnerabilities affecting its Community Edition (CE) and Enterprise Edition (EE) platforms. The updates arrive as versions 18.8.4, 18.7.4 and 18.6.6, with the company strongly recommending that all self-managed installations upgrade immediately. GitLab is already running the patched builds, while GitLab Dedicated customers do not need to take any action.

Among the most critical issues resolved is CVE-2025-7659, a high-severity flaw (CVSS 8.0) involving incomplete validation in GitLab’s Web IDE. According to GitLab, the vulnerability could have allowed unauthenticated attackers to steal access tokens and potentially gain entry to private repositories. Several denial-of-service vulnerabilities were also addressed, including CVE-2025-8099, which could enable attackers to crash servers through repeated GraphQL queries, and CVE-2026-0958, which could exhaust system resources by bypassing JSON validation middleware.

The patch also fixes cross-site scripting and injection-based vulnerabilities such as CVE-2025-14560 and CVE-2026-0595. These flaws could allow attackers to inject malicious scripts or manipulate content under certain conditions. Additional medium-severity vulnerabilities affecting Markdown processing, dashboards and server-side request forgery (SSRF) risks have also been resolved, alongside several lower-severity authorisation and validation flaws.

GitLab states that the affected versions include all builds from multiple release branches prior to the newly released patches. The company notes that security vulnerability details are typically made public 30 days after a fix is released. The organisation emphasises that upgrading to the latest supported version is considered essential for maintaining secure deployments.

The patch release also includes database migrations that may temporarily impact availability. Single-node installations are expected to experience downtime during upgrades, while multi-node deployments can complete the update without downtime when following recommended upgrade procedures.

GitLab follows a regular patch release schedule twice monthly but may issue additional updates when critical vulnerabilities are discovered. The company advises administrators to review release notes, test upgrades in staging environments and deploy the latest patches as soon as possible to reduce potential exploitation risks.