Every CVE Search/ Get API key

CVE-2021-22205

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab...

10.0 CriticalIn KEVPublic exploitFix available

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.7%Up 97.9 points since Apr 27, 2021
90%50%10%1%

What each source reports

CVE List Score used 10.0

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Record
CVE-2021-22205
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2021-9351 10.0

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Record
EUVD-2021-9351
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-vgp2-3hxm-6x85 10.0

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab...

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Record
GHSA-vgp2-3hxm-6x85
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-20, CWE-94
Updated
2026-11-02
CISA KEV No score

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.

Record
CVE-2021-22205
Weakness
CWE-20, CWE-95
Updated
2026-11-02
NVD 10.0

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Record
CVE-2021-22205
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
OSV 10.0

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Record
CVE-2021-22205
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-22205 10.0

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Record
UBUNTU-CVE-2021-22205
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-gitlab-2021-22205 No score

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Record
BIT-gitlab-2021-22205
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gitlab
Bitnami
 11.9.0 up to 13.8.8, 13.9.0 up to 13.9.6, 13.10.0 up to 13.10.3
13.8.813.9.613.10.3
gitlab
Ubuntu:16.04:LTS
 All versions, plus listed versions
8.4.3+dfsg-98.4.3+dfsg-128.5.8+dfsg-5
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitGitLab Unauthenticated Remote ExifTool Command Injection2021-04-14
PoC in GitHubmr-r3bot/Gitlab-CVE-2021-222052021-06-05
PoC in GitHubXTeam-Wing/CVE-2021-222052021-10-28
PoC in GitHubr0eXpeR/CVE-2021-222052021-10-28
PoC in GitHubAl1ex/CVE-2021-222052021-10-29
PoC in GitHubZZ-SOCMAP/CVE-2021-222052021-10-29
PoC in GitHubfindneo/GitLab-preauth-RCE_CVE-2021-222052021-10-30
PoC in GitHubwhwlsfb/CVE-2021-222052021-10-30
PoC in GitHubc0okB/CVE-2021-222052021-10-31
PoC in GitHubshang159/CVE-2021-22205-getshell2021-11-01
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubdevdanqtuan/CVE-2021-222052021-11-04
PoC in GitHubhh-hunter/cve-2021-222052021-11-05
PoC in GitHubrunsel/GitLab-CVE-2021-22205-2021-11-05
PoC in GitHubfaisalfs10x/GitLab-CVE-2021-22205-scanner2021-11-09
PoC in GitHubinspiringz/CVE-2021-222052021-11-11
Exploit-DBGitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)2021-11-17
PoC in GitHubpizza-power/Golang-CVE-2021-22205-POC2021-11-25
PoC in GitHubDIVD-NL/GitLab-cve-2021-22205-nse2021-11-27
PoC in GitHubw0x68y/Gitlab-CVE-2021-222052021-12-22
PoC in GitHubosungjinwoo/CVE-2021-22205-gitlab2022-03-10
PoC in GitHubmomika233/cve-2021-22205-GitLab-13.10.2---Remote-Code-Execution-RCE-Unauthenticated-2022-04-18
PoC in GitHubkeven1z/CVE-2021-222052022-07-20
PoC in GitHubovergrowncarrot1/DejaVu-CVE-2021-222052023-08-02
PoC in GitHubHikikan/CVE-2021-222052023-09-08
PoC in GitHubNukingDragons/gitlab-cve-2021-222052023-11-01
PoC in GitHubcc3305/CVE-2021-222052024-05-19
PoC in GitHubccordeiro/CVE-2021-222052025-11-19
NucleiGitLab CE/EE - Remote Code Execution

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-22205 is a critical vulnerability (CVSS 10.0) in Gitlab, published April 23, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.7%, the 99th percentile. Fixed in gitlab 13.8.8.

References

Show 5 moreShow less
This page doesn't list everything

The full exploit list has 1 more link.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open