Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (CVE-2024-2434)
GitLab versions 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 contain a path traversal vulnerability. This flaw allows an attacker to bypass pathname restrictions, potentially leading to denial of service (DoS) and unauthorized reading of restricted files. The issue affects both GitLab CE and EE editions. A patch is available to address this vulnerability.
AI Analysis
Technical Summary
CVE-2024-2434 is a path traversal vulnerability in GitLab CE/EE affecting versions 16.9.0 up to but not including 16.9.6, 16.10.0 up to but not including 16.10.4, and 16.11.0 up to but not including 16.11.1. The vulnerability allows improper limitation of pathnames to restricted directories, which can be exploited to cause denial of service or read files that should be restricted. No CVSS score is provided. There are no known exploits in the wild. The vulnerability is patched in versions 16.9.6, 16.10.4, and 16.11.1.
Potential Impact
Exploitation of this vulnerability can lead to denial of service conditions and unauthorized access to restricted files within the GitLab environment. This could impact the confidentiality and availability of the affected system. No active exploitation has been reported.
Mitigation Recommendations
Apply the official patches by upgrading GitLab to versions 16.9.6, 16.10.4, or 16.11.1 or later. Since a patch is available, remediation should be performed promptly to mitigate the risk.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (CVE-2024-2434)
Description
GitLab versions 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 contain a path traversal vulnerability. This flaw allows an attacker to bypass pathname restrictions, potentially leading to denial of service (DoS) and unauthorized reading of restricted files. The issue affects both GitLab CE and EE editions. A patch is available to address this vulnerability.
Affected software
pkg:bitnami/gitlabRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-2434 is a path traversal vulnerability in GitLab CE/EE affecting versions 16.9.0 up to but not including 16.9.6, 16.10.0 up to but not including 16.10.4, and 16.11.0 up to but not including 16.11.1. The vulnerability allows improper limitation of pathnames to restricted directories, which can be exploited to cause denial of service or read files that should be restricted. No CVSS score is provided. There are no known exploits in the wild. The vulnerability is patched in versions 16.9.6, 16.10.4, and 16.11.1.
Potential Impact
Exploitation of this vulnerability can lead to denial of service conditions and unauthorized access to restricted files within the GitLab environment. This could impact the confidentiality and availability of the affected system. No active exploitation has been reported.
Mitigation Recommendations
Apply the official patches by upgrading GitLab to versions 16.9.6, 16.10.4, or 16.11.1 or later. Since a patch is available, remediation should be performed promptly to mitigate the risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-gitlab-2024-2434
- Osv Schema Version
- 1.5.0
- Aliases
- ["CVE-2024-2434"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
Threat ID: 6aa329a391cc7f3848d1c730
Added to database: 09/10/2026, 22:05:23 UTC
Last enriched: 09/10/2026, 22:35:31 UTC
Last updated: 09/10/2026, 23:02:44 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.