CVE-2021-22201

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=13.9, <13.9.5; >=13.10, <13.10.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22201.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/325562Broken Link
https://hackerone.com/reports/1132378Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22201.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/325562Broken Link
https://hackerone.com/reports/1132378Permissions Required, Third Party Advisory

Timeline

Published: Apr 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-222024.3An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in CVE-2021-222039.8An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 befo CVE-2021-222047.8Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing t CVE-2021-2220510.0An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that CVE-2021-222064.9An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other main CVE-2021-222076.5Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injecti CVE-2021-222084.3An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change CVE-2021-222097.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tok CVE-2021-22219.6Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affect CVE-2021-222105.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, G CVE-2021-222114.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances CVE-2021-222127.4ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either p