Exploited vulnerability · CISA KEV

Is CVE-2021-22205 exploited? Yes: in CISA KEV since 3 Nov 2021

Gociux · GitLab Community and Enterprise Editions · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2021-22205, GitLab Community and Enterprise Editions Remote Code Execution Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, 194 days after it was published. It is known to be used in ransomware campaigns. It affects GitLab Community and Enterprise Editions. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.

What to do

1. Check whether you run it. Look for Community and Enterprise Editions in your asset inventory, including appliances and cloud images. Stack check lists every exploited GitLab CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 23 Apr 2021.
4. Get told next time. Email alerts when CISA adds a CVE for GitLab.

Other exploited CVEs in Community and Enterprise Editions

• CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability (3 Feb 2026)

References

• nvd.nist.gov/vuln/detail/CVE-2021-22205

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in November 2021 · GitLab scorecard · act-now radar.