An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
GitLab Community and Enterprise Editions
Apply updates per vendor instructions.
11/3/2021
https://nvd.nist.gov/vuln/detail/CVE-2021-22205
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AV:N/AC:L/Au:N/C:P/I:P/A:P
This vulnerability has a 99.73% probability of being exploited in the next 30 days, ranking higher than 100% of all scored CVEs.
View this score breakdown or calculate a custom score
Learn how severity scores are calculated and what they mean
Best practices for deciding which vulnerabilities to address first
Essential guide to Common Vulnerabilities and Exposures
Understand how CVEs relate to underlying weakness types