CVE-2024-0402 is a critical severity (CVSS 9.9) path traversal flaw in GitLab CE and EE. An authenticated user can write files to arbitrary locations on the GitLab server while creating a workspace. Upgrade to 16.8.1, 16.7.4, 16.6.6 or 16.5.8, depending on your release line.
What's affected
The record says GitLab CE/EE from 16.0 before 16.6.6, 16.7 before 16.7.4, and 16.8 before 16.8.1. The GitLab release post of 25 January 2024 adds a backport to 16.5.8 and says that build contains only this fix and none of the other changes in the release.
The two sources fit together, since 16.5 sits inside the 16.0 range. The practical rule is simple: one of 16.5.8, 16.6.6, 16.7.4 or 16.8.1 or later, matching your minor version. Versions before 16.0 are not listed in the record.
GitLab rates the issue critical with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and a score of 9.9, the same as the record, so there is no severity conflict. The weakness is CWE-22, improper limitation of a pathname to a restricted directory. GitLab says its own team member found the issue internally. The record is not on the CISA Known Exploited Vulnerabilities list, and the release post does not report exploitation.
How to check if you're exposed
Find your GitLab version. The version is shown on the help page when you are signed in, and on a self-managed server you can run:
sudo gitlab-rake gitlab:env:info
That prints the GitLab version among other details. Compare it with the fixed builds above. GitLab.com is run by GitLab, so the self-managed upgrade steps apply to you only if you operate your own instance.
The flaw is reached through workspace creation, so the advisory is the place to confirm which feature settings change your exposure. We did not find a configuration check in the release post, so assume every instance below the fixed builds is affected until you read it.
What to do now
- Record the version of every self-managed GitLab instance, including test and staging.
- Upgrade to 16.8.1, 16.7.4, 16.6.6 or 16.5.8, or any later release, following GitLab's upgrade path guidance.
- Review who can create workspaces and what accounts exist. The flaw needs only an authenticated user, so limit sign ups and remove stale accounts.
- Treat the GitLab server as the asset at risk. File writes on the host can reach beyond repositories, so review recent changes to files outside GitLab data directories if you suspect misuse.
- Read the other fixes in the same release post, which covers several issues.
Why it matters
The score is 9.9 because of scope change: the vector shows the impact reaching beyond the vulnerable component. A user with an ordinary account could place files outside the area the application meant to confine them to, on the server that holds your source code and pipelines.
Path traversal bugs come from building a file path out of input without making sure the result stays inside an intended directory. The standard defence is to resolve the final path and check it before writing. The advisory does not give more detail, and we are not adding any.
Quick check
Does CVE-2024-0402 need an account?
Yes. The record says an authenticated user can write files to arbitrary locations while creating a workspace.
Which GitLab version fixes CVE-2024-0402?
It depends on your line: 16.5.8, 16.6.6, 16.7.4 or 16.8.1. Any later release also contains the fix.
Sources
- Gold entry for CVE-2024-0402
- GitLab critical security release 16.8.1
- GitLab issue 437819 (linked by the record)
Last reviewed: 19 October 2026.
