---
id: CVE-2025-4439
title: >-
  Improper Neutralization of Input During Web Page Generation ('Cross-site
  Scripting') in GitLab
summary: >-
  An issue has been discovered in GitLab CE/EE affecting all versions from 15.10
  before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have
  allowed an authenticated user to perform cross-site scripting attacks when the
  insta…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: GitLab
product: GitLab
affected:
  - GitLab >= 15.10 < 18.0.5
  - GitLab >= 18.1 < 18.1.3
  - GitLab >= 18.2 < 18.2.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-07-25T03:55:24.387871Z'
published: '2025-07-23'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:03:04.008Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-4439'
references:
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/541177'
    label: 'GitLab Issue #541177'
  - url: 'https://hackerone.com/reports/3120111'
    label: 'HackerOne Bug Bounty Report #3120111'
tags:
  - cve.org
epss: 0.0028
epssPercentile: 0.2061
ingestedAt: '2026-11-05T20:33:06.561Z'
---

## Overview

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks.

## Affected

- `GitLab >= 15.10 < 18.0.5`
- `GitLab >= 18.1 < 18.1.3`
- `GitLab >= 18.2 < 18.2.1`

## Remediation

Upgrade to versions 18.0.5, 18.1.3, 18.2.1 or above.