An issue exists in GitLab Community and Enterprise Edition prior to 11.4. It allows Directory Traversal.
gitlab gitlab