CVE-2026-5816
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.
Scoring
- Severity
- HIGH
- CVSS base score
- 8
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
- EPSS probability
- 0.41%
- CWE
- CWE-41
- Published
- 2026-04-22
- Last modified
- 2026-04-23
Affected products
- GitLab GitLab
- GitLab GitLab
Weakness type
Related vulnerabilities
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2026-73019 — Windows URL Moniker Security Feature Bypass Vulnerability
- CVE-2026-72835 — filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
- CVE-2026-66064 — goshs has ACL Bypass & Path Traversal
- CVE-2026-49401 — Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- CVE-2026-50568 — Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
- CVE-2026-34451 — Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories
- CVE-2026-23674 — MapUrlToZone Security Feature Bypass Vulnerability