An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
https://www.darkreading.com/threat-intelligence/earth-lamia-exploits-sql-rce-bugs-asia
https://thehackernews.com/2025/05/china-linked-hackers-exploit-sap-and.html
https://www.securityweek.com/chinese-hacking-group-earth-lamia-targets-multiple-industries/
https://www.trendmicro.com/en_us/research/25/e/earth-lamia.html
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-317a
https://blog.xlab.qianxin.com/catddos-derivative-en/
https://thehackernews.com/2023/12/behind-scenes-of-matveevs-ransomware.html
https://therecord.media/confluence-and-gitlab-servers-targeted-by-new-ransomware-strain