CVE-2021-22203

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=13.10, <13.10.1; >=13.9, <13.9.5; >=13.7.9, <13.8.7

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22203.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/320919Exploit, Issue Tracking, Patch, Vendor Advisory
https://hackerone.com/reports/1098793Exploit, Issue Tracking, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22203.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/320919Exploit, Issue Tracking, Patch, Vendor Advisory
https://hackerone.com/reports/1098793Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Apr 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-222047.8Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing t CVE-2021-2220510.0An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that CVE-2021-222064.9An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other main CVE-2021-222076.5Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injecti CVE-2021-222084.3An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change CVE-2021-222097.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tok CVE-2021-22219.6Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affect CVE-2021-222105.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, G CVE-2021-222114.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances CVE-2021-222127.4ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either p CVE-2021-222136.5A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access tok CVE-2021-222148.6When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all ve