CVE-2025-12506: Use of Incorrectly-Resolved Name or Reference in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from the content available for download, due to improper handling of Git reference name resolution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.0.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12506?
CVE-2025-12506 has a medium severity rating of 4.3.
How do I fix CVE-2025-12506?
To remediate CVE-2025-12506, update GitLab to version 18.11.7, 19.0.4, or 19.1.2 or later.
Who is affected by CVE-2025-12506?
CVE-2025-12506 affects all versions of GitLab from 16.5 before versions 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2.
What type of attack is described by CVE-2025-12506?
CVE-2025-12506 allows an authenticated user to create a repository with displayed content that differs from the actual content.
When was CVE-2025-12506 published?
CVE-2025-12506 was published on July 8, 2026.