CVE-2020-26405

Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locat...

Original description

The description as published by the source.

Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"13.5.2"}]}]

References

advisory gitlab.com
report gitlab.com
report hackerone.com
web nvd.nist.gov