CyberRota Analysis
AI-GeneratedGitLab is vulnerable to a path traversal flaw in the job_id parameter of build/index.js, enabling attackers to manipulate API requests and access unauthorized resources. By supplying specially crafted job_id values, an attacker can escape the intended path and leverage the operator's personal access token to target arbitrary endpoints. Organizations using GitLab should prioritize patching this vulnerability to mitigate potential unauthorized access and data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted job_id values like ../../../user to escape the intended path prefix and access arbitrary GitLab API resources using the operator's personal access token.