GitLab issues critical security release for CVE-2020-10977
GitLab published a critical security release (12.9.4, 12.8.7, 12.7.9) to fix a path traversal vulnerability in GitLab CE/EE, urging immediate upgrades or mitigations for self-managed instances.
Executive briefing: On , GitLab issued a critical security release for GitLab CE/EE versions 12.9.4, 12.8.7, and 12.7.9. The update remediates CVE-2020-10977, a path traversal flaw that could allow unauthorized file reads via project imports, and includes fixes for related account and API issues.
Operator action: Upgrade self-managed GitLab instances to the patched versions immediately or apply the documented workaround to disable project imports. Validate that backup and replica nodes are updated, rotate credentials for any potentially exposed service accounts, and monitor logs for suspicious import activity.
Sources: GitLab’s advisory describes affected versions, mitigation steps, and links to the patched releases.
Continue in the Developer pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Secure Software Supply Chain Tooling Guide — Zeph Tech
Engineer developer platforms that deliver verifiable provenance, SBOM distribution, vendor assurance, and runtime integrity aligned with SLSA v1.0, NIST SP 800-204D, and CISA SBOM…
-
AI-Assisted Development Governance Guide — Zeph Tech
Govern GitHub Copilot, Azure AI, and internal generative assistants with controls aligned to NIST AI RMF 1.0, EU AI Act enforcement timelines, OMB M-24-10, and enterprise privacy…
-
Developer Enablement & Platform Operations Guide — Zeph Tech
Plan AI-assisted development, secure SDLC controls, and runtime upgrades using Zeph Tech research on GitHub Copilot, GitHub Advanced Security, and major language lifecycles.