---
id: "CVE-2021-22204"
kind: "vulnerability"
aliases: ["CVE-2021-22204"]
title: "Perl Exiftool: ExifTool Remote Code Execution Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.99981
exploited: true
status: "open"
category: "package"
products: [{"name": "Perl Exiftool", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exiftool", "exploited", "image-upload", "media-processing", "package", "perl"]
not_affected_if: ["exiftool-not-installed", "no-untrusted-image-parsing"]
published_at: "2021-04-23T18:15:08+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22204", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-22204", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22204", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Perl Exiftool: ExifTool Remote Code Execution Vulnerability

ExifTool, a Perl library and command-line tool for reading image metadata, mishandles user data in the DjVu file format from version 7.44 onward. An attacker who gets a crafted image parsed by ExifTool can run arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Perl Exiftool affected ? fixed ?

## How to check

Run exiftool -ver and compare against the fixed release in the vendor advisory; check whether any service parses uploaded images with exiftool.

## Fix

Upgrade ExifTool to a fixed version per vendor instructions (fixed version not stated in the sources).

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22204
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-22204
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-22204

## From the sources

Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_