CVE-2025-0194

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-0194
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-0194.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-0194
Aliases
Downstream
Related
Published
2025-01-08T20:02:01.498Z
Modified
2026-02-18T02:34:45.593628Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab
Details

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0194.json",
    "cwe_ids": [
        "CWE-538"
    ],
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
22193b3da887c1fa5e49021fa8f87b74e6539a7a
Fixed
0340daef06280ec9013da1c6330694de204cad4d
Database specific 
{
    "versions": [
        {
            "introduced": "17.4"
        },
        {
            "fixed": "17.5.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
a8830741d3c4ad7f6a70eed38ee7af31f298d093
Fixed
c3e8793de11e6cbfa919c1b97933e15404f1687e
Database specific 
{
    "versions": [
        {
            "introduced": "17.6"
        },
        {
            "fixed": "17.6.3"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1fd574ee5710155adf5307fba45132264dcb64a1
Fixed
3c8f631cd0ad8efb987effc4447b1d9b25f35b61
Database specific 
{
    "versions": [
        {
            "introduced": "17.7"
        },
        {
            "fixed": "17.7.1"
        }
    ]
}

Affected versions

v17.*
v17.6.0-ee
v17.6.1-ee
v17.6.2-ee
v17.6.2-rc30-ee
v17.6.2-rc31-ee
v17.7.0-ee

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-0194.json"