Vendor

GitLab

Vulnerabilities in GitLab Community and Enterprise Edition — the DevOps platform that, when compromised, can expose an organization's entire source code history and CI/CD pipeline secrets.

CVEs

CVE-2021-22205

[ CRITICAL ] CVSS 9.9 kev

GitLab CE/EE ExifTool Remote Code Execution

An improper-validation vulnerability in GitLab Community Edition and Enterprise Edition allows an unauthenticated attacker to achieve remote code execution by uploading a crafted image file processed through a vulnerable ExifTool image-metadata parser.

GitLab / GitLab CE/EE Apr 14, 2021

Articles

~/articles/2026-07-06-gitlab-exiftool-rce-cve-2021-22205

Explainer

gitlab

GitLab's ExifTool RCE: A Patch That Sat Unrecognized for Months

CVE-2021-22205 was quietly fixed in April 2021 — but its full unauthenticated remote-code-execution severity wasn't widely understood until late 2021, by which point mass exploitation had already begun.

Jul 6 read →