Summary
generated automatically from NVD dataGitLab versions before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 contain a cross-site scripting (CWE-79) flaw. An attacker can embed a SCRIPT element in an SVG document uploaded as an issue attachment or avatar, which may run script in a victim's browser when the file is viewed. The issue carries a CVSS v3.0 score of 6.1 (MEDIUM), and it requires user interaction.
NVD description
GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.
EPSS · FIRST.org
0.88%probability of exploitation in the next 30 days
Higher than 59% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.
CVSS v3.0 Score
Information
- Published
- 4 mai 2017
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (4)
- https://about.gitlab.com/2017/02/15/gitlab-8-dot-16-dot-5-security-release/PatchRelease NotesVendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/27471ExploitVendor Advisory
- https://about.gitlab.com/2017/02/15/gitlab-8-dot-16-dot-5-security-release/PatchRelease NotesVendor Advisory
- https://gitlab.com/gitlab-org/gitlab-ce/issues/27471ExploitVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-79
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.