#gitlab

Analysis · May 20, 2026 · analysis-desk

GitLab CVE-2021-22205: the upload that ran code through an image parser

CVE-2021-22205 is an unauthenticated RCE in GitLab, but the bug wasn't really in GitLab. It was in ExifTool, the metadata library GitLab used to process uploaded images. Upload a crafted file, ExifTool parses it, code runs. Image parsers are a recurring RCE vector.