CVE-2026-3855

6.8 Moyenne

Publiée le 16/09/2026 à 09:16 · Modifiée le 28/09/2026 à 15:27 · Analysée par le NVD · Source : cve@gitlab.com

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cause denial of service due to improper validation of parameters in the Terraform state upload functionality.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.1 Faible	cve@gitlab.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N`
3.1	6.8 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H`

Faiblesses (CWE)

CWE-99

Références

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ Release NotesVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/592821 Broken Link
https://hackerone.com/reports/3575167 Permissions Required

CVE-2026-3855

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs