# Importing GitLab project archives can replace uploads of other users

Importing a crafted GitLab project archive overwrites another user's upload file when its secret and filename are known, enabling backdoored binaries.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: ajxchapman
- Disclosed: 2019-12-11
- CVE: CVE-2019-5469
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/534794
- Library page: https://bugbountylibrary.com/r/h1%3A534794
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:file-upload vuln:idor

**Target:** GitLab project import / uploads storage
**Root cause:** Project import writes uploaded files into a shared uploads path keyed only by secret/filename, without checking whether that upload already belongs to another project/user, so an imported archive can overwrite existing served uploads.
**Steps:**
1. As root, create a project and upload a file (e.g. via a new issue).
2. Note the upload's `secret` and `file name`.
3. Craft a project export tar.gz containing a replacement file at path `./uploads/<secret>/<filename>`, e.g. `./uploads/ed5ab56bc85699117ba230eb799fd3bf/indi.jpg`.
4. As user test, create a new project importing the crafted tar.gz.
5. As root, refresh the upload URL and observe the content was replaced.
**How found:** Researcher noticed the import log served a file from the importing user's project path (`test/modified_project/...`) when requesting another user's upload URL (`root/new_project/...`), revealing shared upload storage keyed by secret/filename.
**Exploitation:** Attacker identifies secret and filename of a victim's upload (trivial for public repos), builds a malicious export archive placing arbitrary content at that upload path, and imports it as their own project; GitLab then serves the attacker's file at the victim's original upload URL.
**Escalation:** Backdooring project compiled binaries distributed via uploads to spread malware.
**Insight:** Archive/import features that restore files into a global uploads directory keyed by secret+filename let any importer overwrite existing objects; test import/export round-trips for cross-tenant file collisions.