CVE-2025-13335
📋 TL;DR
This vulnerability allows authenticated users in GitLab to create malformed Wiki documents that bypass cycle detection, potentially causing a denial of service (DoS) condition. It affects GitLab Community Edition (CE) and Enterprise Edition (EE) installations running specific vulnerable versions, requiring user authentication for exploitation.
💻 Affected Systems
- GitLab Community Edition (CE)
- GitLab Enterprise Edition (EE)
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
An attacker could cause prolonged service unavailability by repeatedly exploiting this to exhaust server resources, disrupting all GitLab operations for users.
Likely Case
Targeted or accidental DoS attacks degrading Wiki functionality and potentially affecting overall GitLab performance for authenticated users.
If Mitigated
With proper access controls and monitoring, impact is limited to temporary Wiki disruptions, as exploitation requires authentication and may be detected.
🎯 Exploit Status
Exploitation details are referenced in HackerOne report 3418023, but no public proof-of-concept is confirmed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.6.4, 18.7.2, or 18.8.2
Vendor Advisory: https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released/
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update GitLab to version 18.6.4, 18.7.2, or 18.8.2 using your package manager (e.g., apt for Ubuntu: sudo apt update && sudo apt install gitlab-ce=18.8.2). 3. Restart GitLab services: sudo gitlab-ctl restart.
🔧 Temporary Workarounds
Restrict Wiki access
allLimit Wiki creation and editing permissions to trusted users only to reduce attack surface.
Monitor for anomalies
allSet up monitoring for unusual Wiki activity or resource usage spikes that may indicate exploitation attempts.
🧯 If You Can't Patch
- Implement strict access controls to limit Wiki functionality to essential users only.
- Deploy rate limiting or WAF rules to block excessive Wiki requests that could trigger the DoS condition.
🔍 How to Verify
Check if Vulnerable:
Check your GitLab version; if it falls within the affected ranges (e.g., 17.1 to 18.6.3, 18.7.0 to 18.7.1, or 18.8.0 to 18.8.1), you are vulnerable.Check Version:
sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Verify Fix Applied:
After patching, confirm the version is 18.6.4, 18.7.2, or 18.8.2 and test Wiki functionality for normal operation without DoS symptoms.📡 Detection & Monitoring
Log Indicators:
- Unusual spikes in Wiki-related logs, errors related to cycle detection, or authentication logs from suspicious users creating Wiki documents.
Network Indicators:
- Increased HTTP requests to Wiki endpoints, especially POST requests for document creation or updates.
SIEM Query:
source="gitlab.log" AND ("wiki" OR "cycle detection") AND status>=400