{"id":"CVE-2021-22205","aliases":["BIT-gitlab-2021-22205","EUVD-2021-9351","GHSA-vgp2-3hxm-6x85","UBUNTU-CVE-2021-22205"],"status":"published","title":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab...","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.99731,"percentile":0.99953,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-94","CWE-95"],"published":"2021-04-23T17:39:36Z","modified":"2026-10-30T10:30:38Z","kev":{"date_added":"2021-11-03","due_date":"2021-11-17","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/gitlab_exif_rce","title":"GitLab Unauthenticated Remote ExifTool Command Injection","type":"exploit","platform":"Linux,Unix","date":"2021-04-14","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/gitlab_exif_rce"},{"source":"pocgithub","id":"mr-r3bot/Gitlab-CVE-2021-22205","title":"mr-r3bot/Gitlab-CVE-2021-22205","date":"2021-06-05","url":"https://github.com/mr-r3bot/Gitlab-CVE-2021-22205"},{"source":"pocgithub","id":"XTeam-Wing/CVE-2021-22205","title":"XTeam-Wing/CVE-2021-22205","date":"2021-10-28","url":"https://github.com/XTeam-Wing/CVE-2021-22205"},{"source":"pocgithub","id":"r0eXpeR/CVE-2021-22205","title":"r0eXpeR/CVE-2021-22205","date":"2021-10-28","url":"https://github.com/r0eXpeR/CVE-2021-22205"},{"source":"pocgithub","id":"Al1ex/CVE-2021-22205","title":"Al1ex/CVE-2021-22205","date":"2021-10-29","url":"https://github.com/Al1ex/CVE-2021-22205"},{"source":"pocgithub","id":"ZZ-SOCMAP/CVE-2021-22205","title":"ZZ-SOCMAP/CVE-2021-22205","date":"2021-10-29","url":"https://github.com/ZZ-SOCMAP/CVE-2021-22205"},{"source":"pocgithub","id":"findneo/GitLab-preauth-RCE_CVE-2021-22205","title":"findneo/GitLab-preauth-RCE_CVE-2021-22205","date":"2021-10-30","url":"https://github.com/findneo/GitLab-preauth-RCE_CVE-2021-22205"},{"source":"pocgithub","id":"whwlsfb/CVE-2021-22205","title":"whwlsfb/CVE-2021-22205","date":"2021-10-30","url":"https://github.com/whwlsfb/CVE-2021-22205"},{"source":"pocgithub","id":"c0okB/CVE-2021-22205","title":"c0okB/CVE-2021-22205","date":"2021-10-31","url":"https://github.com/c0okB/CVE-2021-22205"},{"source":"pocgithub","id":"shang159/CVE-2021-22205-getshell","title":"shang159/CVE-2021-22205-getshell","date":"2021-11-01","url":"https://github.com/shang159/CVE-2021-22205-getshell"},{"source":"pocgithub","id":"devdanqtuan/CVE-2021-22205","title":"devdanqtuan/CVE-2021-22205","date":"2021-11-04","url":"https://github.com/devdanqtuan/CVE-2021-22205"},{"source":"pocgithub","id":"hh-hunter/cve-2021-22205","title":"hh-hunter/cve-2021-22205","date":"2021-11-05","url":"https://github.com/hh-hunter/cve-2021-22205"},{"source":"pocgithub","id":"runsel/GitLab-CVE-2021-22205-","title":"runsel/GitLab-CVE-2021-22205-","date":"2021-11-05","url":"https://github.com/runsel/GitLab-CVE-2021-22205-"},{"source":"pocgithub","id":"faisalfs10x/GitLab-CVE-2021-22205-scanner","title":"faisalfs10x/GitLab-CVE-2021-22205-scanner","date":"2021-11-09","url":"https://github.com/faisalfs10x/GitLab-CVE-2021-22205-scanner"},{"source":"pocgithub","id":"inspiringz/CVE-2021-22205","title":"inspiringz/CVE-2021-22205","date":"2021-11-11","url":"https://github.com/inspiringz/CVE-2021-22205"},{"source":"exploitdb","id":"EDB-50532","title":"GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)","type":"webapps","platform":"ruby","date":"2021-11-17","url":"https://www.exploit-db.com/exploits/50532"},{"source":"pocgithub","id":"pizza-power/Golang-CVE-2021-22205-POC","title":"pizza-power/Golang-CVE-2021-22205-POC","date":"2021-11-25","url":"https://github.com/pizza-power/Golang-CVE-2021-22205-POC"},{"source":"pocgithub","id":"DIVD-NL/GitLab-cve-2021-22205-nse","title":"DIVD-NL/GitLab-cve-2021-22205-nse","date":"2021-11-27","url":"https://github.com/DIVD-NL/GitLab-cve-2021-22205-nse"},{"source":"pocgithub","id":"w0x68y/Gitlab-CVE-2021-22205","title":"w0x68y/Gitlab-CVE-2021-22205","date":"2021-12-22","url":"https://github.com/w0x68y/Gitlab-CVE-2021-22205"},{"source":"pocgithub","id":"osungjinwoo/CVE-2021-22205-gitlab","title":"osungjinwoo/CVE-2021-22205-gitlab","date":"2022-03-10","url":"https://github.com/osungjinwoo/CVE-2021-22205-gitlab"},{"source":"pocgithub","id":"momika233/cve-2021-22205-GitLab-13.10.2---Remote-Code-Execution-RCE-Unauthenticated-","title":"momika233/cve-2021-22205-GitLab-13.10.2---Remote-Code-Execution-RCE-Unauthenticated-","date":"2022-04-18","url":"https://github.com/momika233/cve-2021-22205-GitLab-13.10.2---Remote-Code-Execution-RCE-Unauthenticated-"},{"source":"pocgithub","id":"keven1z/CVE-2021-22205","title":"keven1z/CVE-2021-22205","date":"2022-07-20","url":"https://github.com/keven1z/CVE-2021-22205"},{"source":"pocgithub","id":"overgrowncarrot1/DejaVu-CVE-2021-22205","title":"overgrowncarrot1/DejaVu-CVE-2021-22205","date":"2023-08-02","url":"https://github.com/overgrowncarrot1/DejaVu-CVE-2021-22205"},{"source":"pocgithub","id":"Hikikan/CVE-2021-22205","title":"Hikikan/CVE-2021-22205","date":"2023-09-08","url":"https://github.com/Hikikan/CVE-2021-22205"},{"source":"pocgithub","id":"NukingDragons/gitlab-cve-2021-22205","title":"NukingDragons/gitlab-cve-2021-22205","date":"2023-11-01","url":"https://github.com/NukingDragons/gitlab-cve-2021-22205"},{"source":"pocgithub","id":"cc3305/CVE-2021-22205","title":"cc3305/CVE-2021-22205","date":"2024-05-19","url":"https://github.com/cc3305/CVE-2021-22205"},{"source":"pocgithub","id":"ccordeiro/CVE-2021-22205","title":"ccordeiro/CVE-2021-22205","date":"2025-11-19","url":"https://github.com/ccordeiro/CVE-2021-22205"},{"source":"nuclei","id":"CVE-2021-22205","title":"GitLab CE/EE - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22205.yaml"}],"exploits_more":2,"fixes":[{"ecosystem":"Bitnami","package":"gitlab","fixed_in":["13.8.8","13.9.6","13.10.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"gitlab","ranges":[{"type":"SEMVER","events":[{"introduced":"11.9.0"},{"fixed":"13.8.8"},{"introduced":"13.9.0"},{"fixed":"13.9.6"},{"introduced":"13.10.0"},{"fixed":"13.10.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gitlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.3+dfsg-9","8.4.3+dfsg-12","8.5.8+dfsg-5"]}],"products":[{"vendor":"gitlab","product":"community and enterprise editions"},{"vendor":"gitlab","product":"gitlab"}],"references":[{"url":"https://hackerone.com/reports/1154542","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","advisory","report"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/327121","tags":["x_refsource_MISC","x_transferred","Broken Link","web","report"]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22205","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vgp2-3hxm-6x85"},{"url":"https://ubuntu.com/security/CVE-2021-22205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22205","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-22205","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","status":"published","published":"2021-04-23T17:39:36Z","modified":"2026-08-06T03:55:21.716Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:58.028461Z"}],"euvd":[{"id":"EUVD-2021-9351","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","status":"published","published":"2021-04-23T17:39:36Z","modified":"2026-08-06T03:55:21Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T18:02:09.520152Z"}],"ghsa":[{"id":"GHSA-vgp2-3hxm-6x85","title":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab...","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","status":"published","published":"2022-05-24T17:48:44Z","modified":"2025-10-22T00:32:07Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T15:04:04.786232Z"}],"kev":[{"id":"CVE-2021-22205","title":"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","description":"GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.","cwes":["CWE-20","CWE-95"],"kev":{"date_added":"2021-11-03","due_date":"2021-11-17","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2021-22205","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","status":"published","published":"2021-04-23T18:15:08.167Z","modified":"2026-08-06T05:16:35.427Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:06:52.03307Z"}],"osv":[{"id":"CVE-2021-22205","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","status":"published","published":"2021-04-23T18:15:08.167Z","modified":"2026-10-30T10:30:38.506332981Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"UBUNTU-CVE-2021-22205","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","status":"published","published":"2021-04-23T18:15:00Z","modified":"2025-10-24T04:50:07Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"BIT-gitlab-2021-22205","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","status":"published","published":"2024-03-06T11:20:01.948Z","modified":"2026-09-08T08:48:23.048318737Z","updated_at":"2026-11-02T15:28:29.999658Z"}]}}