Overview
GitLab has patched a high-severity remote code execution vulnerability (CVE-2026-10053, CVSS 8.5) affecting GitLab Community Edition and Enterprise Edition. The flaw exists in the package registry component and can be triggered by an authenticated user to execute arbitrary code on the GitLab server under certain conditions.
Affected versions span a wide range of recent GitLab releases:
- 18.8 up to (not including) 19.0.6
- 19.1 up to (not including) 19.1.4
- 19.2 up to (not including) 19.2.2
GitLab 19.0.6, 19.1.4, and 19.2.2 contain the fix.
Technical Details
The vulnerability is a path traversal flaw in the package registry upload or processing pipeline. GitLab's package registry supports multiple formats (npm, Maven, PyPI, Conan, Helm, and others), and the server-side code that handles incoming package files failed to sufficiently validate file paths provided by the client.
By crafting a malicious package upload request with a path-traversal sequence (e.g., ../../../) in the filename or package metadata, an authenticated attacker can write files to arbitrary locations on the server's filesystem that are accessible to the GitLab process. In the right circumstances — such as writing to a location that GitLab evaluates as code (e.g., ERB templates, hooks, or other interpreted files) — this file write translates to remote code execution.
The "under certain conditions" qualifier in GitLab's advisory is typical language to acknowledge that exploitability may depend on how the instance is configured (e.g., filesystem layout, GitLab version, enabled package formats) while still confirming the RCE potential.
CVSS Breakdown
| Metric | Value |
|---|---|
| Score | 8.5 (High) |
| Vector | Network |
| Complexity | High |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity | High |
| Availability | High |
The High complexity rating reflects the conditional nature of the RCE path — an attacker requires some knowledge of the target's file layout to achieve code execution, rather than being a fully reliable one-step exploit.
Impact
A successful exploit could allow an authenticated GitLab user (including users with only Reporter or Developer access) to:
- Write arbitrary files to locations accessible by the GitLab server process
- Achieve remote code execution on the GitLab application server
- Access or exfiltrate all repository data, CI/CD secrets, access tokens, and environment variables stored on the instance
- Pivot to internal networks accessible from the GitLab server
- Establish persistent access via web shells or modified GitLab configuration
Self-managed GitLab instances are at highest risk. GitLab.com (SaaS) is separately managed by GitLab and patched independently.
Remediation
Upgrade immediately to one of the patched versions:
- GitLab 19.2.2 or later
- GitLab 19.1.4 or later
- GitLab 19.0.6 or later
If an immediate upgrade is not possible:
- Disable the package registry via Admin Area → Settings → General → Visibility and access controls until patching is possible.
- Restrict who can publish packages — limit package registry write access to trusted users only via project or group-level permissions.
- Review recent package uploads for anomalous filenames containing
..,/, or other traversal sequences. - Monitor filesystem changes on your GitLab server for unexpected file creation outside of expected directories.