Executive brief
GitLab's Terraform state upload feature contains a validation flaw that could allow an authenticated user with project-level permissions to read sensitive files from the server or trigger service outages. Terraform state files are used by infrastructure teams to manage cloud resources, and unauthorized access or disruption to this functionality could expose secrets, credentials, and configuration data or prevent legitimate infrastructure operations.
Technical details
The vulnerability is an improper input validation issue in the Terraform State API of GitLab CE/EE. An authenticated user with project-level permissions can exploit inadequate parameter validation in the Terraform state upload functionality to achieve two attack outcomes: arbitrary file read via path traversal and denial of service. The attack requires authentication and project-level access but does not require user interaction. GitLab has patched the issue in versions 19.1.8, 19.2.6, and 19.3.2, with backports also released for 19.0.9 and 18.11.12.
Affected products
- GitLab GitLab CE 18.2.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
- GitLab GitLab EE 18.2.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched: Patches released in versions 19.1.8, 19.2.6, 19.3.2