漏洞描述
Gitlab Wiki API是一组用于对Gitlab项目Wiki页面进行创建、编辑、列表、删除等功能的接口。该API在处理外部输入时未做有效过滤，导致攻击者构造特定的恶意请求，可以在目标服务器上执行任意代码命令。需要private_token,以及需要一个project的id拼接成的路径，project=8拼接：（/api/v4/projects/8/wikis/attachments）
Gitlab Wiki API 远程命令执行漏洞(CVE-2018-18649)
PoC代码
暂无相关漏洞推荐
-
CVE-2020-26413: GitLab Information Disclosure POC
2025-09-01 | GitLabfofa app="GitLab" -
CVE-2021-22205: GitLab CE/EE Unauthenticated RCE Using ExifTool POC
2025-09-01 | GitLab CE EEAn issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was n... -
gitlab-weak-login: Gitlab Default Login POC
2025-09-01 | GitlabGitlab default login credentials were discovered. -
CVE-2018-1000600: Pre-auth Fully-responded SSRF POC
2025-09-01 | Pre-authA exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier... -
CVE-2018-1000861: Jenkins 2.138 Remote Command Execution POC
2025-09-01 | JenkinsA code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier...