CVE-2024-2434: High Path Traversal in GitLab CE and EE

CVE-2024-2434 is a high severity (CVSS 8.5) path traversal in GitLab CE and EE. Per the NVD record, it can cause denial of service and restricted file read. Upgrade 16.9 to 16.9.6, 16.10 to 16.10.4, and 16.11 to 16.11.1 or later.

What's affected

The NVD record lists all GitLab CE and EE versions in three branches:

• 16.9 prior to 16.9.6
• 16.10 prior to 16.10.4
• 16.11 prior to 16.11.1

So the fixed versions are 16.9.6, 16.10.4 and 16.11.1, with later releases also fixed. Older branches than 16.9 are not named in the record. I could not load GitLab's own patch release notes while writing this, so confirm the affected range and any additional fixed versions in the official GitLab release post for 16.11.1.

On severity, the record gives 8.5 (high). I found no second score from the vendor in the pages I could read, so there is no conflict to report.

How to check if you're exposed

Self managed instances show their version at the Help page, or under the Admin Area. You can also read it from the command line on an Omnibus install:

sudo gitlab-rake gitlab:env:info

That prints the GitLab version. Compare it with the branch list above. GitLab.com is run by the vendor, so this applies to self managed deployments.

What to do now

1. Find every self managed GitLab instance, including test and forgotten ones.
2. Upgrade to 16.9.6, 16.10.4, 16.11.1 or a later release in your branch.
3. Read the official GitLab patch release notes for the full list of fixes shipped with these versions.
4. If an instance cannot be patched at once, limit who can run CI pipelines and upload job artifacts, since that is the usual way untrusted input reaches a build server. This is general hardening, not a vendor workaround.
5. Watch Sidekiq and memory use for unexplained spikes after the upgrade window.

Why it matters

The weakness is CWE-22, path traversal. A value that should name a file inside a fixed folder is used to build a path, and special sequences let it point somewhere else. The record says this can end in a denial of service or a read of restricted files.

GitLab issue 450303, linked from the record, describes a related traversal in how a security report schema path is built from an uploaded artifact, with the effect of hanging background workers. The page I read did not name this CVE, so treat it as context and not as the advisory itself.

The record does not say the flaw was exploited, and the CVE is not on the CISA Known Exploited Vulnerabilities list.

Code hosting servers hold source and secrets, so even a read limited to restricted files deserves a prompt patch. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can help you find what your own projects depend on.

Quick check

Sources

• NVD record for CVE-2024-2434
• GitLab issue 450303

Last reviewed: 19 October 2026.