{"history":[{"alert":0,"cve":"CVE-2021-22205","id":22132,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2021-22205","id":19751,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2021-22205","id":17717,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2021-22205","id":15781,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2021-22205","id":13759,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2021-22205","id":11541,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2021-22205","id":9527,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":1,"cve":"CVE-2021-22205","id":9263,"kind":"cna","observed_at":1793917201,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-03T18:37:18.228Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://hackerone.com/reports/1154542\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://gitlab.com/gitlab-org/gitlab/-/issues/327121\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2021-22205\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2021-10-26T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2021-11-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-94\", \"description\": \"CWE-94 Improper Control of Generation of Code ('Code Injection')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-08-06T03:55:21.716Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"GitLab\", \"vendor\": \"GitLab\", \"versions\": [{\"status\": \"affected\", \"version\": \">=11.9, <13.8.8\"}, {\"status\": \"affected\", \"version\": \">=13.9, <13.9.6\"}, {\"status\": \"affected\", \"version\": \">=13.10, <13.10.3\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Thanks vakzz for reporting this vulnerability through our HackerOne bug bounty program\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Improper control of generation of code ('code injection') in GitLab\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2021-11-17T16:06:20.000Z\", \"orgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"shortName\": \"GitLab\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://hackerone.com/reports/1154542\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://gitlab.com/gitlab-org/gitlab/-/issues/327121\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"cve@gitlab.com\", \"ID\": \"CVE-2021-22205\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"GitLab\", \"version\": {\"version_data\": [{\"version_value\": \">=11.9, <13.8.8\"}, {\"version_value\": \">=13.9, <13.9.6\"}, {\"version_value\": \">=13.10, <13.10.3\"}]}}]}, \"vendor_name\": \"GitLab\"}]}}, \"credit\": [{\"lang\": \"eng\", \"value\": \"Thanks vakzz for reporting this vulnerability through our HackerOne bug bounty program\"}], \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.\"}]}, \"impact\": {\"cvss\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Improper control of generation of code ('code injection') in GitLab\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://hackerone.com/reports/1154542\", \"refsource\": \"MISC\", \"url\": \"https://hackerone.com/reports/1154542\"}, {\"name\": \"https://gitlab.com/gitlab-org/gitlab/-/issues/327121\", \"refsource\": \"MISC\", \"url\": \"https://gitlab.com/gitlab-org/gitlab/-/issues/327121\"}, {\"name\": \"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json\", \"refsource\": \"CONFIRM\", \"url\": \"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json\"}, {\"name\": \"http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html\"}, {\"name\": \"http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"assignerShortName\": \"GitLab\", \"cveId\": \"CVE-2021-22205\", \"datePublished\": \"2021-04-23T17:39:36.000Z\", \"dateReserved\": \"2021-01-05T00:00:00.000Z\", \"dateUpdated\": \"2026-08-06T03:55:21.716Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2021-22205","id":7075,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2021-22205","id":4852,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2021-22205","id":2634,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":1,"cve":"CVE-2021-22205","id":1559,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2021-22205\", \"cwes\": [\"CWE-20\", \"CWE-95\"], \"dateAdded\": \"2021-11-03\", \"dueDate\": \"2021-11-17\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2021-22205\", \"product\": \"Community and Enterprise Editions\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.\", \"vendorProject\": \"GitLab\", \"vulnerabilityName\": \"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability\"}"}],"record":{"affected":[{"product":"GitLab","vendor":"GitLab","versions":[{"status":"affected","version":">=11.9, <13.8.8"},{"status":"affected","version":">=13.9, <13.9.6"},{"status":"affected","version":">=13.10, <13.10.3"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-03T18:37:18.228Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://hackerone.com/reports/1154542"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/327121"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2021-22205","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2021-10-26T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2021-11-03","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-06T03:55:21.716Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"GitLab","vendor":"GitLab","versions":[{"status":"affected","version":">=11.9, <13.8.8"},{"status":"affected","version":">=13.9, <13.9.6"},{"status":"affected","version":">=13.10, <13.10.3"}]}],"credits":[{"lang":"en","value":"Thanks vakzz for reporting this vulnerability through our HackerOne bug bounty program"}],"descriptions":[{"lang":"en","value":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"Improper control of generation of code ('code injection') in GitLab","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2021-11-17T16:06:20.000Z","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","shortName":"GitLab"},"references":[{"tags":["x_refsource_MISC"],"url":"https://hackerone.com/reports/1154542"},{"tags":["x_refsource_MISC"],"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/327121"},{"tags":["x_refsource_CONFIRM"],"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@gitlab.com","ID":"CVE-2021-22205","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"GitLab","version":{"version_data":[{"version_value":">=11.9, <13.8.8"},{"version_value":">=13.9, <13.9.6"},{"version_value":">=13.10, <13.10.3"}]}}]},"vendor_name":"GitLab"}]}},"credit":[{"lang":"eng","value":"Thanks vakzz for reporting this vulnerability through our HackerOne bug bounty program"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper control of generation of code ('code injection') in GitLab"}]}]},"references":{"reference_data":[{"name":"https://hackerone.com/reports/1154542","refsource":"MISC","url":"https://hackerone.com/reports/1154542"},{"name":"https://gitlab.com/gitlab-org/gitlab/-/issues/327121","refsource":"MISC","url":"https://gitlab.com/gitlab-org/gitlab/-/issues/327121"},{"name":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json","refsource":"CONFIRM","url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json"},{"name":"http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html"},{"name":"http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html"}]}}}},"cveMetadata":{"assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","assignerShortName":"GitLab","cveId":"CVE-2021-22205","datePublished":"2021-04-23T17:39:36.000Z","dateReserved":"2021-01-05T00:00:00.000Z","dateUpdated":"2026-08-06T03:55:21.716Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794370801,"cve":"CVE-2021-22205","description":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","epss":{"date":"2026-11-12","epss":0.99731,"percentile":0.99953},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2021-22205","cwes":["CWE-20","CWE-95"],"dateAdded":"2021-11-03","dueDate":"2021-11-17","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-22205","product":"Community and Enterprise Editions","requiredAction":"Apply updates per vendor instructions.","shortDescription":"GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.","vendorProject":"GitLab","vulnerabilityName":"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability"},"kev_checked":1794522003,"products":"GitLab GitLab","references":["https://hackerone.com/reports/1154542","https://gitlab.com/gitlab-org/gitlab/-/issues/327121","https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json","http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html","http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"GitLab","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}