Improper Handling of URL Encoding (Hex Encoding) in GitLab (CVE-2025-11990)
GitLab Enterprise Edition versions from 18.4.0 up to but not including 18.4.4, and from 18.5.0 up to but not including 18.5.2, contained a vulnerability involving improper handling of URL encoding in repository references. This flaw could allow an authenticated user to obtain CSRF tokens by exploiting weaknesses in input validation combined with redirect handling. The issue has been remediated in versions 18.4.4 and 18.5.2.
AI Analysis
Technical Summary
CVE-2025-11990 describes a vulnerability in GitLab EE where improper input validation of URL-encoded repository references, combined with redirect handling weaknesses, could allow an authenticated user to gain CSRF tokens. This vulnerability affects GitLab EE versions >=18.4.0 <18.4.4 and >=18.5.0 <18.5.2. The vendor has released patches in versions 18.4.4 and 18.5.2 to address this issue.
Potential Impact
An authenticated user could exploit this vulnerability to obtain CSRF tokens, potentially enabling unauthorized actions that rely on such tokens. The severity is assessed as low, indicating limited impact or exploitability.
Mitigation Recommendations
A fix is available. Users should upgrade GitLab EE to version 18.4.4 or later if on the 18.4 branch, or to version 18.5.2 or later if on the 18.5 branch to remediate this vulnerability.
Improper Handling of URL Encoding (Hex Encoding) in GitLab (CVE-2025-11990)
Description
GitLab Enterprise Edition versions from 18.4.0 up to but not including 18.4.4, and from 18.5.0 up to but not including 18.5.2, contained a vulnerability involving improper handling of URL encoding in repository references. This flaw could allow an authenticated user to obtain CSRF tokens by exploiting weaknesses in input validation combined with redirect handling. The issue has been remediated in versions 18.4.4 and 18.5.2.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-11990 describes a vulnerability in GitLab EE where improper input validation of URL-encoded repository references, combined with redirect handling weaknesses, could allow an authenticated user to gain CSRF tokens. This vulnerability affects GitLab EE versions >=18.4.0 <18.4.4 and >=18.5.0 <18.5.2. The vendor has released patches in versions 18.4.4 and 18.5.2 to address this issue.
Potential Impact
An authenticated user could exploit this vulnerability to obtain CSRF tokens, potentially enabling unauthorized actions that rely on such tokens. The severity is assessed as low, indicating limited impact or exploitability.
Mitigation Recommendations
A fix is available. Users should upgrade GitLab EE to version 18.4.4 or later if on the 18.4 branch, or to version 18.5.2 or later if on the 18.5 branch to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-gitlab-2025-11990
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2025-11990"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Low
Threat ID: 6aa329a291cc7f3848d1c50a
Added to database: 09/10/2026, 22:05:22 UTC
Last enriched: 09/10/2026, 22:28:13 UTC
Last updated: 09/10/2026, 22:28:13 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.