CVE-2018-14364

GitLab lets teams import projects by uploading files, but this flaw lets an attacker sneak a file outside the folder it's supposed to stay in — like slipping a forged key under the wrong door and letting themselves into the whole building. Once in, they can run their own commands on your server, meaning they could steal code, data, or shut everything down.

This matters to you if you run GitLab Community Edition or Enterprise Edition, especially a version released before 10.7.7, 10.8.6, or 11.0.4. It's a risk if your GitLab server is reachable from the internet and the project import feature is turned on — no login or user action is needed for an attacker to exploit it.

This flaw lets attackers remotely run code on your server with no login required, and working exploit tools are already publicly available, so the risk of exploitation is real and growing. It has not been confirmed as actively exploited in the wild or added to the official list of known exploited threats, but the public exploit availability and rising attack likelihood mean you should prioritize patching soon rather than treat it as low-priority.

Confirm your running version via the GitLab admin interface or gitlab-rake gitlab:env:info. If you're on any version before 10.7.7 (10.7.x branch), before 10.8.6 (10.8.x branch), or before 11.0.4 (11.x branch), you are vulnerable. Upgrade to the corresponding fixed release (10.7.7, 10.8.6, or 11.0.4+) following GitLab's standard upgrade documentation for your current branch, checking for breaking changes between minor versions. If immediate upgrade isn't feasible, disable or restrict access to the projects import component as a stopgap, and ensure the GitLab instance is not directly internet-facing without a reverse proxy/WAF in front of it. Monitor for unusual file writes under the uploads directory and unexpected process execution on the GitLab host. Two public exploits exist, so treat this as a priority even though it is not currently in CISA's Known Exploited Vulnerabilities list.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — unauthenticated, network-exploitable, no user interaction, full compromise of confidentiality, integrity, and availability. Weakness: CWE-22 (Path Traversal) in the GitLab projects import component, enabling arbitrary file write outside the intended upload directory and resultant remote code execution. Exploit maturity: two public exploits are known. EPSS score is elevated and trending upward (99th percentile), indicating high predicted likelihood of exploitation, though it is not currently listed in CISA KEV and no confirmed in-the-wild exploitation has been reported.