NetSight
IP …
high7.1

CVE-2020-26405

Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations.

Impact

Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

Affected products

VendorProductAffected versions
GitlabGitlab
from 12.8.0 before 13.3.9
from 13.4.0 before 13.4.5
from 13.5.0 before 13.5.2

Weakness classification

CWE-22

References