CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
Published Apr 23, 2021 · Updated Aug 6, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More GitLab vulnerabilities
All GitLab entriesCVE-2026-103515
GitLab EE improper access control in group Duo admin-lock enforcement for Amazon Q settings
low2.7Oct 21, 2026CVE-2026-105711
GitLab CE/EE use of cache containing sensitive information in merge request title rendering
low3.5Oct 21, 2026CVE-2026-105777
GitLab CE/EE internal credential exposure in internal response headers
medium4.3Oct 21, 2026CVE-2026-110264
GitLab CE/EE integer overflow in regular expression compiler allows unauthenticated remote code execution
critical10.0Oct 21, 2026CVE-2026-112212
GitLab CE/EE cache poisoning in OAuth/OIDC discovery endpoints
high7.5Oct 21, 2026CVE-2026-112326
GitLab EE improper cleanup on thrown exception in security findings
low3.1Oct 21, 2026