CVE-2025-6168

Published Jul 10, 2025·Updated Jun 17, 2026

NVD Description

An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.

Public Exploits & PoCs2 found

[POC] CVE-2025-61686 — CVE-2025-61686-PoC

React Router's createFileSessionStorage() in certain versions allows unsigned cookies to be manipulated, enabling file system access outside the session directory.

[POC] CVE-2025-61686 — CVE-2025-61686_docker

CVE-2025-61686复现的dockerfile与poc

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free