{"id":"CVE-2023-2825","published":"2023-05-26T00:00:00Z","modified":"2025-01-15T15:45:18Z","title":"An issue has been discovered in GitLab CE/EE affecting only version 16.0.0","vendor":"GitLab","product":"GitLab","tier":"core","eol":null,"affectedVersions":[{"vendor":"GitLab","product":"GitLab","versions":["16.0.0"]}],"description":{"text":"An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.","provenance":"source","from":"CVE.org"},"summary":{"text":"A path traversal flaw in GitLab CE/EE version 16.0.0 lets a malicious user read arbitrary files on the server. An unauthenticated attacker can exploit it over the network without user interaction, but only when an attachment exists in a public project nested within at least five groups.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:34Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.71641,"percentile":0.9942,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-02","exploitedFirstSeen":"2026-08-02","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-02&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-02"},{"url":"https://previdian.com/CVE-2023-2825","date":"2026-08-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-03&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-04&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-06&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-07&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-13&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-16&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-21&host_type=src&vulnerability=cve-2023-2825","date":"2026-08-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-21&host_type=src&vulnerability=cve-2023-2825","date":"2026-09-21"}],"evidenceTotal":13,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/412371","tags":[]},{"url":"https://hackerone.com/reports/1994725","tags":[]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2825.json","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-34276","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-34276","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2023-05-25","earliestUrl":"https://github.com/Occamsec/CVE-2023-2825","repos":[{"name":"Occamsec/CVE-2023-2825","url":"https://github.com/Occamsec/CVE-2023-2825","stars":139,"created":"2023-05-25"},{"name":"Groppoxx/CVE-2023-2825-PoC","url":"https://github.com/Groppoxx/CVE-2023-2825-PoC","stars":4,"created":"2026-05-17"},{"name":"Tornad0007/CVE-2023-2825-Gitlab","url":"https://github.com/Tornad0007/CVE-2023-2825-Gitlab","stars":0,"created":"2023-05-30"},{"name":"Rubikcuv5/CVE-2023-2825","url":"https://github.com/Rubikcuv5/CVE-2023-2825","stars":0,"created":"2023-06-05"},{"name":"cc3305/CVE-2023-2825","url":"https://github.com/cc3305/CVE-2023-2825","stars":0,"created":"2024-06-20"}]},"metasploit":[{"name":"GitLab Authenticated File Read","module":"auxiliary/gather/gitlab_authenticated_subgroups_file_read","type":"auxiliary","disclosureDate":"2023-05-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb"}],"nuclei":[{"id":"CVE-2023-2825","name":"GitLab 16.0.0 - Path Traversal","severity":"high","path":"http/cves/2023/CVE-2023-2825.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2825.yaml"}],"first":{"date":"2023-05-23","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-05-23","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-05-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb","provenance":"source"},{"date":"2023-05-26","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-2825","provenance":"source"},{"date":"2026-08-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-02&host_type=src&vulnerability=cve-2023-2825","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":71.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 91 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9942"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}