Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab has released fixes for a critical flaw that allows unauthenticated remote code execution on self-managed servers. The vulnerability affects all versions of the software dating back to version 7.0, which was released in 2014. This means that every version of GitLab over the past 12 years is impacted. The fix is necessary even for administrators who applied a patch on October 12, as that update only covered versions 19.2 and later. The new fixed versions are one patch above the previous update. Administrators who patched earlier will still need to apply the new fix to protect their systems.