{"id":"CVE-2021-22205","kind":"vulnerability","aliases":["CVE-2021-22205"],"related":[],"title":"GitLab Community and Enterprise Editions: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","description":"GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.\n\nCISA required action: Apply updates per vendor instructions.","summary":"GitLab CE and EE accept image uploads through GitLab Workhorse, which passes them to ExifTool, and ExifTool does not validate the files properly. An unauthenticated attacker can upload a crafted image and run code on the GitLab server.","severity":"critical","cvss":10.0,"epss":0.99731,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"GitLab Community and Enterprise Editions","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","gitlab","gitlab-ce","gitlab-ee","ransomware","runtime","self-hosted"],"not_affected_if":["gitlab.com-hosted","image-uploads-disabled"],"how_to_check":"Check the GitLab version installed on the instance, e.g. with gitlab-rake gitlab:env:info or the version shown in the admin area, and compare it to the fixed versions in the vendor advisory.","fix":"Upgrade GitLab CE/EE to a patched release per the vendor instructions referenced by CISA; the exact fixed version is unknown from the sources.\nRotate any secrets on affected instances if compromise is suspected.","status":"open","published_at":"2021-04-23T18:15:08+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:38+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T21:33:38Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade GitLab CE/EE to a patched release per the vendor instructions referenced by CISA; the exact fixed version is unknown from the sources.\nRotate any secrets on affected instances if compromise is suspected.","reach":"internet","impact":"high","summary":"GitLab CE and EE accept image uploads through GitLab Workhorse, which passes them to ExifTool, and ExifTool does not validate the files properly. An unauthenticated attacker can upload a crafted image and run code on the GitLab server.","category":"runtime","who_cares":["gitlab","self-hosted","gitlab-ce","gitlab-ee"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the GitLab server.","analyst_note":"Find the exact patched GitLab versions and the vendor advisory in the GitLab release notes and CISA KEV entry; confirm whether unauthenticated upload is reachable by default.","how_to_check":"Check the GitLab version installed on the instance, e.g. with gitlab-rake gitlab:env:info or the version shown in the admin area, and compare it to the fixed versions in the vendor advisory.\nunknown","needs_analyst":true,"not_affected_if":["gitlab.com-hosted","image-uploads-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000535,"input_tokens":2882,"output_tokens":493,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':16A,19A '-22205':17A,20A 'abil':85C 'accept':43B 'action':113C 'and':23A 'appli':114C 'attack':64B 'ce':30B,40B 'cisa':111C 'code':12A,72B,96C 'communiti':2A,7A,78C 'community':22A 'craft':68B 'cve':15A,18A 'edit':5A,10A,81C 'editions':25A 'ee':33B,42B 'enterpris':4A,9A,80C 'enterprise':24A 'execut':13A,97C 'exiftool':53B,55B,104C 'exploit':26B 'extens':102C 'file':60B,101C,110C 'github':77C 'gitlab':1A,6A,21A,27B,29B,32B,39B,47B,75B,90C 'gitlab-c':28B 'gitlab-e':31B 'host':38B 'imag':44B,69B,88C,100C,109C 'improp':106C 'instruct':118C 'pass':50B,99C 'per':116C 'proper':61B 'ransomwar':34B 'remot':11A,95C 'requir':112C 'run':71B 'runtim':35B 'self':37B 'self-host':36B 'server':76B 'unauthent':63B 'updat':115C 'upload':45B,66B,87C 'util':83C 'valid':58B,107C 'vendor':117C 'vulner':14A,93C 'workhors':48B,91C,98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-04-23T18:15:08+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-22205","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22205","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T20:35:38+00:00","note":null},{"source":"epss","external_id":"CVE-2021-22205","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22205","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-22205","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22205","severity":null,"published_at":"2021-04-23T18:15:08+00:00","modified_at":"2026-08-06T05:16:35+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}