CVE-2021-22205

CRITICALCVSS 10.0Known Exploited

CISA Known Exploited Vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2021-22205

Remediation deadline: November 17, 2021

Ransomware use: Known

Description

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.

Timeline

Published:April 23rd, 2021 6:15 PM

Last modified:August 1st, 2026 5:16 AM

Added to KEV:November 3rd, 2021

CVSS Scoring

CVSS v3: 10.0 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2: 7.5

Affected Software

From NVD CPE configuration data

Vendors

gitlab

Products

gitlab

Weaknesses (CWE)

CWE-94

References & Reports

Advisories, patches, and third-party reports

http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.htmlExploit
http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.htmlExploit
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/327121Broken Link
https://hackerone.com/reports/1154542Permissions Required
http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.htmlExploit
http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.htmlExploit
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/327121Broken Link
https://hackerone.com/reports/1154542Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205US Government Resource

Source: NIST NVD · Data may lag official sources by up to one minute