Vulnerability intelligence
CVE-2021-22205
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
GitLab Community and Enterprise Editions
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
CVSS Score
10
Critical
EPSS — Exploit Probability
—
Awaiting FIRST.org data
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
unknown
Federal deadline 2021-11-17
CISA required action
Apply updates per vendor instructions. Deadline for federal agencies: 2021-11-17.
1 article across 1 outlet · first covered Oct 8, 2026 · latest Oct 8, 2026
Associated threat actors
Coverage timeline
-
China-Based Hackers Accused of Stealing Emails Across 7 Countriesthehackernews.com · Oct 8, 2026