GitLab Patch Release: 18.6.2, 18.5.4, 18.4.6

{
  "id": "3a64a2c867c501608e410f96fa2d71b3b5b0fdc40d08756e1a8289db9275fae0",
  "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-6-2-released/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "GitLab Patch Release: 18.6.2, 18.5.4, 18.4.6",
    "summary": "GitLab released security fixes in GitLab CE and EE versions 18.6.2, 18.5.4, and 18.4.6. The announcement recommends upgrading installations running affected versions to the latest version.",
    "evidence": "On December 10, 2025, we released versions 18.6.2, 18.5.4, 18.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.",
    "products": [
      {
        "name": {
          "value": "GitLab CE/EE",
          "evidence": "GitLab CE/EE: all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2"
        },
        "prerequisites": [
          {
            "value": "all types are affected",
            "evidence": "When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected."
          }
        ],
        "fixed_versions": [
          {
            "value": "18.4.6",
            "evidence": "On December 10, 2025, we released versions 18.6.2, 18.5.4, 18.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
          },
          {
            "value": "18.5.4",
            "evidence": "On December 10, 2025, we released versions 18.6.2, 18.5.4, 18.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
          },
          {
            "value": "18.6.2",
            "evidence": "On December 10, 2025, we released versions 18.6.2, 18.5.4, 18.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
          }
        ],
        "affected_versions": [
          {
            "value": "all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2",
            "evidence": "GitLab CE/EE: all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2"
          }
        ]
      },
      {
        "name": {
          "value": "GitLab EE",
          "evidence": "Impacted Versions: GitLab EE: all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "18.4.6",
            "evidence": "On December 10, 2025, we released versions 18.6.2, 18.5.4, 18.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
          },
          {
            "value": "18.5.4",
            "evidence": "On December 10, 2025, we released versions 18.6.2, 18.5.4, 18.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
          },
          {
            "value": "18.6.2",
            "evidence": "On December 10, 2025, we released versions 18.6.2, 18.5.4, 18.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE)."
          }
        ],
        "affected_versions": [
          {
            "value": "all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2",
            "evidence": "Impacted Versions: GitLab EE: all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-12716",
        "evidence": "CVE-2025-12716 - Cross-site scripting issue in Wiki impacts GitLab CE/EE"
      },
      {
        "value": "CVE-2025-12029",
        "evidence": "CVE-2025-12029 - Cross-site scripting issue in Swagger UI impacts GitLab CE/EE"
      },
      {
        "value": "CVE-2025-8405",
        "evidence": "CVE-2025-8405 - Improper encoding in vulnerability reports impacts GitLab CE/EE"
      },
      {
        "value": "CVE-2025-12562",
        "evidence": "CVE-2025-12562 - Denial of service issue in GraphQL endpoints impacts GitLab CE/EE"
      },
      {
        "value": "CVE-2025-11984",
        "evidence": "CVE-2025-11984 - Authentication bypass issue for WebAuthn users impacts GitLab CE/EE"
      },
      {
        "value": "CVE-2025-4097",
        "evidence": "CVE-2025-4097 - Denial of service issue in ExifTool processing impacts GitLab CE/EE"
      },
      {
        "value": "CVE-2025-14157",
        "evidence": "CVE-2025-14157 - Denial of service issue in Commit API impacts GitLab CE/EE"
      },
      {
        "value": "CVE-2025-11247",
        "evidence": "CVE-2025-11247 - Information disclosure issue in compliance frameworks impacts GitLab EE"
      },
      {
        "value": "CVE-2025-13978",
        "evidence": "CVE-2025-13978 - Information disclosure through error messages impacts GitLab CE/EE"
      },
      {
        "value": "CVE-2025-12734",
        "evidence": "CVE-2025-12734 - HTML injection issue in merge request titles impacts GitLab CE/EE"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-gitlab-security-releases",
  "document_id": 23770,
  "published_at": "2025-12-10T00:00:00+00:00"
}