CVE-2026-1458

MEDIUM

GitLab 8.0-18.6.5, 18.7-18.7.3, 18.8-18.8.3 - Unauthenticated Denial of Service via Malicious File Upload

Title source: llm
STIX 2.1

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files.

References (3)

Core 3
Core References
Broken Link, Issue Tracking issue-tracking permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/587698
Permissions Required technical-description exploit permissions-required
https://hackerone.com/reports/3517644

Scores

CVSS v3 6.5
EPSS 0.0036
EPSS Percentile 28.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-434 CWE-770
Status published
Products (1)
gitlab/gitlab 8.0.0 - 18.6.6 (2 CPE variants)
Published Feb 11, 2026
Tracked Since Feb 18, 2026