CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.7% chance of exploitation in the next 30 days.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Affected products

• GitLab GitLab: from 11.9.0, before 13.8.8 (fixed in 13.8.8); from 13.9.0, before 13.9.6 (fixed in 13.9.6); from 13.10.0, before 13.10.3 (fixed in 13.10.3)

Published 2021-04-23. Last modified 2026-08-06.