CVE-2016-9086

GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files (tar). All GitLab versions prior to 8.13.0 restricted this feature to administrators only. Starting with version 8.13.0 this feature was made available to all users. This feature did not properly check for symbolic links in user-provided archives and therefore it was possible for an authenticated user to retrieve the contents of any file accessible to the GitLab service account. This included sensitive files such as those that contain secret tokens used by the GitLab service to authenticate users. GitLab CE and EE versions 8.13.0 through 8.13.2, 8.12.0 through 8.12.7, 8.11.0 through 8.11.10, 8.10.0 through 8.10.12, and 8.9.0 through 8.9.11 are affected.

• CWE-200

• http://www.securityfocus.com/bid/94136Third Party Advisory, VDB Entry
• https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/Mitigation, Patch, Vendor Advisory
• http://www.securityfocus.com/bid/94136Third Party Advisory, VDB Entry
• https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/Mitigation, Patch, Vendor Advisory

Published

Nov 3, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9080Memory safety bugs were reported in Firefox 50.0.2. Some of …
• CVE-2016-9081Joomla! 3.4.4 through 3.6.3 allows attackers to reset userna…
• CVE-2016-9082Integer overflow in the write_png function in cairo 1.14.6 a…
• CVE-2016-9083drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.…7.8
• CVE-2016-9084drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel throug…
• CVE-2016-9085Multiple integer overflows in libwebp allows attackers to ha…3.3
• CVE-2016-9087SQL injection vulnerability in framework/modules/filedownloa…
• CVE-2016-9091Blue Coat Advanced Secure Gateway (ASG) 6.6 before 6.6.5.4 a…
• CVE-2016-9092The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1…
• CVE-2016-9093A version of the SymEvent Driver that shipped with Symantec …
• CVE-2016-9094Symantec Endpoint Protection clients place detected malware …
• CVE-2016-9095Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…