ACTIEF MISBRUIKT
CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
| Leverancier | GitLab |
|---|---|
| Product | Community and Enterprise Editions |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 3 nov 2021 |
| CISA-deadline (Amerikaanse overheid) | 17 nov 2021 |
| Gebruik door ransomware | Bekend |
| Zwakte (CWE) | CWE-20, CWE-95 |
Vereiste actie (tekst van CISA, Engels)
Apply updates per vendor instructions.
Beschrijving (NVD, Engels)
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
BRONNEN
Andere lekken bij GitLab
- CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- CVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- CVE-2021-22175: GitLab Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.