CVE-2021-22205
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote c...
Affects 1 product across 1 vendor.
Attacker injects arbitrary code that is executed by the application process.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical vulnerability in GitLab CE/EE (CVE-2021-22205) allows remote attackers to execute arbitrary commands due to improper validation of image files. This affects all versions starting from 11.9 and has a CVSS score of 10.0, indicating severe impact on confidentiality, integrity, and availability. The vulnerability is actively exploited and has a public proof-of-concept, making it highly likely to be used in attacks against affected systems.
BSID: BS-2021-GLOBAL-249720-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-22205?
What is the CVSS score for CVE-2021-22205?
Is CVE-2021-22205 actively exploited?
How do I remediate CVE-2021-22205?
What systems are affected by CVE-2021-22205?
What NERC-CIP standard applies to CVE-2021-22205?
What IEC 62443 requirement maps to CVE-2021-22205?
| CVE ID | CVE-2021-22205 |
|---|---|
| BSID | BS-2021-GLOBAL-249720-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2021-04-23 |
| Last Modified | 2026-08-06 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Domains | |
| Source | NVD |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from GitLab's failure to properly validate image files before passing them to a file parser. This can lead to remote command execution, allowing an attacker to gain full control over the affected system. The attack can be performed remotely without authentication, making it particularly dangerous in environments where GitLab is exposed to untrusted networks.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Gitlab | Gitlab | ≥ 11.9.0, < 13.8.8 ≥ 13.9.0, < 13.9.6 ≥ 13.10.0, < 13.10.3 |
| CISA known-exploited | ● Active Exploitation Confirmed (added 2021-11-03) |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
Implement strict input validation and sanitization for all file uploads, especially images, to prevent malicious content from being processed. Additionally, ensure that the application runs with the least privilege necessary to minimize the impact of potential exploitation.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This vulnerability violates CIP-007-R2 by failing to protect the cyber assets from unauthorized access and manipulation, which could compromise the reliability of the bulk electric system.
This vulnerability maps to SR 7.6 as it involves the protection of software from unauthorized modification, which is crucial for maintaining the security and integrity of industrial control systems.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 106f18df8e6f80acdd7b2f2eacad9203be54d02abf92ad983650dcce1ecebc293a0d607e0bbc2e180b1aada839fa2697c4d2eb4059a53246b45cd0aded1a7af9 |
This Vulnerability Is Being Actively Exploited
CVE-2021-22205 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →