CVE-2023-3906

3.5 lowEPSS 0.6%

Low (3.5) in gitlab gitlab. EPSS 0.6% chance of exploitation in the next 30 days.

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.

Severity

CVSS 3.1

3.5 low

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-1287
Published: 2023-09-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitlab:gitlab

References

https://gitlab.com/gitlab-org/gitlab/-/issues/419213
https://hackerone.com/reports/2071411
https://gitlab.com/gitlab-org/gitlab/-/issues/419213
https://hackerone.com/reports/2071411

Check your stack JSON