November 3, 2021 · Applied Cybernetics Group
CVE-2021-22205 — GitLab Community and Enterprise Editions
known ransomware use
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
- Added to KEV
2021-11-03- Federal due date
2021-11-17- Vendor
- GitLab
- Product
- Community and Enterprise Editions
- EPSS
- 100.0th percentile (score 0.945, as of
2026-06-08) - NVD CVSS v3.1
- —
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2021-22205
CISA short description
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
Required action
Apply updates per vendor instructions.