---
id: "CVE-2021-22205"
kind: "vulnerability"
aliases: ["CVE-2021-22205"]
title: "GitLab Community and Enterprise Editions: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99731
exploited: true
status: "open"
category: "runtime"
products: [{"name": "GitLab Community and Enterprise Editions", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "gitlab", "gitlab-ce", "gitlab-ee", "ransomware", "runtime", "self-hosted"]
not_affected_if: ["gitlab.com-hosted", "image-uploads-disabled"]
published_at: "2021-04-23T18:15:08+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22205", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-22205", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22205", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# GitLab Community and Enterprise Editions: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

GitLab CE and EE accept image uploads through GitLab Workhorse, which passes them to ExifTool, and ExifTool does not validate the files properly. An unauthenticated attacker can upload a crafted image and run code on the GitLab server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:GitLab Community and Enterprise Editions affected ? fixed ?

## How to check

Check the GitLab version installed on the instance, e.g. with gitlab-rake gitlab:env:info or the version shown in the admin area, and compare it to the fixed versions in the vendor advisory.

## Fix

Upgrade GitLab CE/EE to a patched release per the vendor instructions referenced by CISA; the exact fixed version is unknown from the sources.
Rotate any secrets on affected instances if compromise is suspected.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22205
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-22205
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-22205

## From the sources

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_