UpHeron
All vulnerabilities

Servers and applications

CVE-2021-22205

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021.

Severity
Critical 10.0
Published
23 Apr 2021
Last changed
6 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
13.8.8, 13.9.6, 13.10.3
Sources
NVD

Affected software

SoftwareAffected versions
GitLabServers and applications · cpe:a:gitlab:gitlab
  • From 11.9.0 before 13.8.8
  • From 13.9.0 before 13.9.6
  • From 13.10.0 before 13.10.3

Known exploited

CISA name
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
17 Nov 2021
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-22205
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-22205