CVE-2021-22205: GitLab CE/EE image parser flaw allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with CVSS 10, KEV listing, known ransomware use, and near-maximum EPSS make this an urgent patch.

What it is

GitLab CE/EE failed to properly validate image files passed to a file parser, allowing code injection that leads to remote command execution. The flaw affects all versions starting from 11.9 and is remotely reachable without authentication, making it a severe risk for any exposed GitLab instance.

Impact

An unauthenticated attacker can execute arbitrary commands on the GitLab server, leading to full compromise of the host and any data or credentials it holds.

Attack surface

Reachable over the network via the image upload/parsing path with no authentication or user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Listed in CISA KEV with known ransomware campaign use, and EPSS probability is 0.99731 (99.95th percentile); public exploit references are tagged Exploit.

What to do

• Apply the vendor update for GitLab CE/EE immediately; this is the required KEV action.
• If patching cannot be done at once, restrict network access to GitLab instances and disable or limit unauthenticated image upload paths.
• Monitor GitLab releases for the fixed versions covering all releases from 11.9 onward and verify your deployed version.
• Treat any internet-exposed GitLab instance as compromised until patched and reviewed for signs of command execution.

Detection

• Hunt for unexpected child processes spawned by GitLab/Rails/ExifTool workers, especially shell or interpreter execution.
• Review GitLab and web server logs for malformed or unusual image upload requests and parser errors.
• Monitor for outbound connections or new files/accounts on GitLab hosts consistent with post-exploitation.
• Correlate host telemetry with the KEV listing and known ransomware activity for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.