Skip to content
Back to search

CVE-2021-22205

CRITICAL
10.0 RansomwareNVD

Summary

generated automatically from NVD data

GitLab CE/EE, starting from version 11.9, fails to properly validate image files before passing them to a file parser, which allows remote command execution (classified as CWE-94, code injection). The flaw is rated CRITICAL with a CVSS v3.1 score of 10.0, and it can be exploited over the network without authentication or user interaction. CISA lists it in its KEV catalog (added 2021-11-03), with known use in ransomware campaigns.

NVD description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2021-11-17

Used in known ransomware campaigns.

EPSS · FIRST.org

99.7%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

CVSS v3.1 Score

10.0
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Information

Published
23 avr. 2021
Updated
6 août 2026
Status
Analyzed
Source
cve@gitlab.com

Affected products

gitlab gitlab
Versions : 13.8.8, 13.9.6, 13.10.3

Weaknesses (CWE)

CWE-94CWE-94

References (11)

Similar CVEs

Other vulnerabilities of type CWE-94

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring