CVE-2024-2434
CVE-2024-2434 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read.
CVSS 8.5 · High · EPSS 23.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
gitlab
- Versions
- ≥ 16.9, < 16.9.6: Affected (semver)
- ≥ 16.10, < 16.10.4: Affected (semver)
- ≥ 16.11, < 16.11.1: Affected (semver)
Update to 16.10.4; Update to 16.11.1; Update to 16.9.6
gitlab Ubuntu:16.04:LTS
- Versions
- 8.4.3+dfsg-9
- 8.4.3+dfsg-12
- 8.5.8+dfsg-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gitlab-agent Ubuntu:24.04:LTS
- Versions
- 14.1.0-1
- 16.1.3-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gitlab-agent Ubuntu:25.10
- Versions
- 16.1.3-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gitlab-agent Ubuntu:26.10
- Versions
- 16.1.3-2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gitlab-agent Ubuntu:26.04:LTS
- Versions
- 16.1.3-2
- 16.1.3-2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published