CVE-2021-22205
CISA KEV RANSOMWARE
ACT NOW
Priority: 0.00
BB Relevance:
0/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
CISA Known Exploited Vulnerability
Vendor / Product
GitLab — Community and Enterprise Editions
Date Added
2021-11-03
Remediation Due
2021-11-17
Ransomware Use
CONFIRMED
https://nvd.nist.gov/vuln/detail/CVE-2021-22205
Weakness Classification (1)
Affected Software (6)
References & Advisories (6)
Vendor Advisory
US Government Resource
Permissions Required
Third Party Advisory
Exploit
Third Party Advisory
VDB Entry
Exploit
Third Party Advisory
VDB Entry
Broken Link