CVE-2025-4278 HIGH

CVE-2025-4278: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

Vendor Gitlab

Product GitLab

Weakness CWE-80 · XSS · basic

Published June 12, 2025

Last update June 12, 2025

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.

Key dates

02Disclosure timeline

June 12, 2025 CVE published

June 12, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-4278 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/80.html

Related vulnerabilities

04Related CVE

CVE-2024-38859 XSS in view page with SLA column CVE-2026-20170 CVE-2025-58970 WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability CVE-2021-32719 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management plugin CVE-2025-11874 Slippy Slider – Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting