GitLab CVE-2023-2825 Path Traversal Exploitation Attempt via Uploads Endpoint

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•2

Detects attempts to exploit CVE-2023-2825, a path traversal vulnerability in GitLab. The rule monitors HTTP GET requests to the /uploads/ endpoint containing directory traversal sequences (e.g., ../ or encoded variants) in the URI, indicating an effort to access restricted files on the system.