CVE-2018-14364: GitLab project import path traversal leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction required, and public exploit references make this a high-urgency fix despite absence from KEV.

What it is

GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 is vulnerable to directory traversal in the projects import component. The flaw allows write access outside intended paths, which can be chained into remote code execution. It matters because GitLab is a widely deployed source-code platform and the issue is remotely reachable with no privileges or user interaction per the CVSS vector.

Impact

An attacker can write files to arbitrary locations on the GitLab server and leverage that write access to achieve remote code execution. This yields full compromise of confidentiality, integrity and availability of the host.

Attack surface

Reached over the network through the GitLab projects import component; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required. The description does not specify the exact request path or whether a valid session is needed in practice.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.50 probability (98.8th percentile) and multiple references are tagged Exploit, indicating public exploit detail exists. No ransomware group usage is documented.

What to do

• Upgrade GitLab Community and Enterprise Edition to 10.7.7, 10.8.6, 11.0.4 or later as applicable to your release line.
• If immediate upgrade is not possible, restrict or disable the projects import feature and limit network access to the GitLab web interface.
• Run GitLab with least privilege and isolate it from sensitive internal networks and credentials.
• Monitor GitLab release notes and vendor advisories for follow-up fixes or workarounds.
• Audit file system write locations and permissions on GitLab hosts for unexpected changes.

Detection

• Review GitLab application and web server logs for anomalous project import requests, especially traversal sequences such as ../ in import parameters.
• Monitor file system integrity in GitLab data, repository and configuration directories for unexpected new or modified files.
• Alert on unexpected process execution or outbound connections originating from the GitLab server.
• Correlate import activity with subsequent file writes or command execution events on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.