Actively exploited in the wild
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
GitLab - Community and Enterprise Editions · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-22205
CriticalCVSS 10.0KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A vulnerability in GitLab CE/EE from version 11.9 allows remote code execution due to improper validation of image files passed to a parser.
Risk Assessment
An attacker can take control of the GitLab server, leading to data confidentiality and integrity breaches.
Recommendation
Immediately update GitLab to a patched version (13.10.3, 13.9.6, 13.8.8 or later).
Original NVD description (English source)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.