{"id":"CVE-2021-22204","kind":"vulnerability","aliases":["CVE-2021-22204"],"related":[],"title":"Perl Exiftool: ExifTool Remote Code Execution Vulnerability","description":"Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image\n\nCISA required action: Apply updates per vendor instructions.","summary":"ExifTool, a Perl library and command-line tool for reading image metadata, mishandles user data in the DjVu file format from version 7.44 onward. An attacker who gets a crafted image parsed by ExifTool can run arbitrary code.","severity":"high","cvss":7.8,"epss":0.99981,"exploited":true,"exploited_at":"2021-11-17T00:00:00+00:00","products":[{"name":"Perl Exiftool","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exiftool","exploited","image-upload","media-processing","package","perl"],"not_affected_if":["exiftool-not-installed","no-untrusted-image-parsing"],"how_to_check":"Run exiftool -ver and compare against the fixed release in the vendor advisory; check whether any service parses uploaded images with exiftool.","fix":"Upgrade ExifTool to a fixed version per vendor instructions (fixed version not stated in the sources).","status":"open","published_at":"2021-04-23T18:15:08+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:32:04+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:32:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade ExifTool to a fixed version per vendor instructions (fixed version not stated in the sources).\nUnknown from sources: confirm the exact fixed release at the vendor advisory.","reach":"unknown","impact":"high","summary":"ExifTool, a Perl library and command-line tool for reading image metadata, mishandles user data in the DjVu file format from version 7.44 onward. An attacker who gets a crafted image parsed by ExifTool can run arbitrary code.","category":"package","who_cares":["exiftool","perl","image-upload","media-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the server parsing the image.","analyst_note":"Find the fixed ExifTool version and whether DjVu parsing is on by default, via the vendor advisory at exiftool.org and the NVD entry for CVE-2021-22204.","how_to_check":"Run exiftool -ver and compare against the fixed release in the vendor advisory; check whether any service parses uploaded images with exiftool.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["exiftool-not-installed","no-untrusted-image-parsing"],"user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000511,"input_tokens":2827,"output_tokens":457,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':9A,12A '-22204':10A,13A '7.44':49B,78C 'action':92C 'allow':81C 'appli':93C 'arbitrari':63B,82C 'attack':52B 'cisa':90C 'code':5A,64B,83C 'command':32B 'command-lin':31B 'craft':56B 'cve':8A,11A 'data':41B,69C 'djvu':44B,72C 'execut':6A,84C 'exiftool':2A,3A,15A,16B,26B,60B,76C 'exploit':17B 'file':45B,73C 'format':46B,74C 'get':54B 'imag':19B,37B,57B,89C 'image-upload':18B 'improp':65C 'instruct':97C 'librari':29B 'line':33B 'malici':88C 'media':22B 'media-process':21B 'metadata':38B 'mishandl':39B 'neutral':66C 'onward':50B 'packag':24B 'pars':58B,86C 'per':95C 'perl':1A,14A,25B,28B 'process':23B 'read':36B 'remot':4A 'requir':91C 'run':62B 'tool':34B 'updat':94C 'upload':20B 'user':40B,68C 'vendor':96C 'version':48B,77C 'vulner':7A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-04-23T18:15:08+00:00","kev":{"dateAdded":"2021-11-17","dueDate":"2021-12-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-22204","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22204","severity":null,"published_at":"2021-11-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2021-22204","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22204","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-22204","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22204","severity":null,"published_at":"2021-04-23T18:15:08+00:00","modified_at":"2026-06-17T03:36:47+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}