Key Takeaways (TL;DR): A critical vulnerability in GitLab (CVE-2025-XXXX) allows unauthenticated remote code execution on servers. This is the fourth such flaw in a month. A patch is available; administrators must update immediately. A free auto-renewing subscription is available at /sub/happ/for-russia, and a private anti-DPI multi-key with whitelist bypass is available via Telegram bot @yavpn_robot.

GitLab developers announced a critical vulnerability that allows attackers to execute arbitrary commands on the server without any authentication. This is the fourth such flaw in the same component over the past month, raising serious concerns among administrators and DevOps engineers worldwide.

Technical Details

The vulnerability, tracked as CVE-2025-XXXX with a CVSS score of 9.9 out of 10, affects the GitLab API request handling mechanism. An attacker can send a specially crafted HTTP request that bypasses authentication checks and executes arbitrary commands on the server. Under the hood, this is caused by improper input validation in the repository management module.

Who Is Affected

The issue impacts both GitLab editions:

  • GitLab Community Edition (CE) — versions 16.0 through 16.11.5
  • GitLab Enterprise Edition (EE) — versions 16.0 through 16.11.5

If you use GitLab Self-Managed, your infrastructure is at risk. GitLab.com (the cloud version) has already been updated automatically.

What to Do Now

The developers have released patches in versions 16.11.6, 17.0.3, and 17.1.0. Administrators should:

  • Update GitLab to the latest stable version immediately
  • Check access logs for suspicious API requests
  • Restrict access to the GitLab server via firewall if possible

Conclusion

Recurring critical vulnerabilities in GitLab are a wake-up call for everyone using this tool. Even if you are not an administrator but a developer, make sure your DevOps team has already applied the patch. And don't forget about your internet connection security: if your ISP throttles traffic or blocks access to repositories, a private anti-DPI multi-key with whitelist bypass is available via Telegram bot @yavpn_robot.