CVE-2021-22205

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Aug 6, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Apr 23, 2021
Last modified: Aug 6, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-222064.9An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other main CVE-2021-222076.5Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injecti CVE-2021-222084.3An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change CVE-2021-222097.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tok CVE-2021-22219.6Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affect CVE-2021-222105.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, G CVE-2021-222114.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances CVE-2021-222127.4ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either p CVE-2021-222136.5A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access tok CVE-2021-222148.6When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all ve CVE-2021-222152.7An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members'CVE-2021-222166.5A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolle