GitLab Community and Enterprise Editions Remote Code Execution Vulnerability (CVE-2021-22205)

What is affected, what to do

An unauthenticated attacker can achieve remote code execution by uploading malicious images to GitLab CE/EE. This vulnerability affects all versions starting from 11.9 and is actively exploited in ransomware campaigns since 2021. Affected products include specific Bitnami GitLab installations. Immediate patching to the latest version is critical to mitigate this risk.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update gitlab to version 13.9.6. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• GitLab gte 11.9, <13.8.8..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Check version and patch: All GitLab CE/EE instances from 11.9 onward are affected, including Bitnami images. Upgrade to the fixed releases: per GitLab's April 2021 security release these are 13.8.8, 13.9.6 and 13.10.3, or any newer supported version. Verify the exact versions in the vendor advisory. Check the running version via gitlab-rake gitlab:env:info or /help.
   • Cut exposure now: Restrict internet-facing instances that cannot be patched within hours to VPN or corporate source ranges at the firewall or reverse proxy (TCP 80/443). Exploitation requires no authentication.
   • Assume compromise and hunt: This bug has been mass-exploited since 2021, so treat any unpatched, exposed instance as likely compromised. Look for:
     • newly created admin accounts (User.where(admin: true) in gitlab-rails console),
     • unknown personal access tokens,
     • cron jobs and processes owned by the git user,
     • cryptominer processes.
   • Rotate secrets if compromise is suspected: Regenerate CI/CD variables, runner registration tokens, deploy keys and deploy tokens, PATs, integration secrets and /etc/gitlab/gitlab-secrets.json. A code host holding pipeline secrets is a direct path into production and cloud accounts.
   • Preserve evidence before rebuilding: Collect /var/log/gitlab/ (workhorse, nginx, gitlab-rails) and the uploads directory before cleanup. On confirmed compromise, rebuild rather than clean in place.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Run GitLab only behind VPN/ZTNA. Apply egress filtering on the GitLab host and allow only required destinations (mirror targets, SMTP, package repos). This kills reverse shells and mining-pool connections.
   • WAF/IPS: Block or inspect HTTP POSTs to /uploads/user and /<namespace>/<project>/uploads whose body contains the DjVu magic AT&TFORM, especially when disguised with a .jpg/.jpeg extension. Drop unauthenticated requests to these paths outright.
   • Configuration workaround: If upgrading is blocked, update the bundled ExifTool to a release fixing CVE-2021-22204 (12.24 or later). Alternatively, strip the DjVu module from ExifTool per GitLab's hotpatch guidance. Note that Omnibus updates overwrite this change.
   • Endpoint hardening: Confine the git service account with AppArmor/SELinux or a container seccomp profile so that perl/exiftool cannot spawn shells (sh, bash) or downloaders (curl, wget).
   • IAM/least privilege: Disable open sign-up (Admin → Settings → Sign-up restrictions). Minimise the number of admins and enforce 2FA on all of them. Scope runner tokens to groups or projects instead of the whole instance.
3. 03

   Runbook step 3

   Detection rules

   • EDR/Sysmon process ancestry: gitlab-workhorse → exiftool/perl → sh/bash/curl/wget/python. Sigma shape: ParentImage|endswith: '/perl' AND ParentCommandLine|contains: 'exiftool' AND Image|endswith: ['/sh','/bash','/curl','/wget']. On Linux with auditd: execve with uid=git and a parent ExifTool process.
   • Web access log (/var/log/gitlab/nginx/gitlab_access.log): POSTs to /uploads/user from external IPs with no prior login, often returning 422. SPL: index=web uri_path="/uploads/user" method=POST | stats count by src_ip, status.
   • Workhorse log (/var/log/gitlab/gitlab-workhorse/current): exiftool command failed or image-processing errors on sessionless requests are a strong indicator of exploit attempts.
   • Network telemetry (Zeek/Suricata): Suricata rule idea: alert http any any -> $GITLAB_SERVERS any (msg:"CVE-2021-22205 DjVu upload"; flow:to_server; http.method; content:"POST"; http.uri; content:"/uploads/"; http.request_body; content:"AT&TFORM"; sid:...;). Also alert on new outbound connections from the GitLab host, such as mining pools or unusual ports.
   • Application audit (production_json.log, Audit Events): New admin users, role flips to admin: true or fresh API tokens shortly after suspicious uploads. Use of gitlab-rails runner for privilege escalation is a known pattern.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Source: OSV (Open Source Vulnerabilities), CISA KEV Catalog, cvelistv5, NVD (NIST)

Vendors and products

• GitLab GitLab

References & sources

• packetstormsecurity.comfiles/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Inj…web, x_refsource_MISC
• packetstormsecurity.comfiles/164994/GitLab-13.10.2-Remote-Code-Execution.htmlweb, x_refsource_MISC
• gitlab.comgitlab-org/cves/-/blob/master/2021/CVE-2021-22205.jsonweb, x_refsource_CONFIRM
• gitlab.comgitlab-org/gitlab/-/issues/327121web, x_refsource_MISC
• hackerone.comreports/1154542web, x_refsource_MISC
• NVD (NIST)vuln/detail/CVE-2021-22205web
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205web, government-resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 06.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2021-22205","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T19:53:08.964558Z"}	{"id":"CVE-2021-22205","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2021-10-26T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 05.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2021-22205","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"rapid"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2021-10-26T00:00:00+00:00"}	{"id":"CVE-2021-22205","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T19:53:08.964558Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0