Loading story…
A critical unauthenticated remote code execution flaw, tracked as CVE-2021-22205, affects GitLab CE and EE by improperly validating image files sent to a file parser. The bug impacts GitLab versions from 11.9 onward in the affected ranges >=11.9,<13.8.8, >=13.9,<13.9.6, and >=13.10,<13.10.3, and carries a CVSS 10.0 rating. GitLab said the issue was reported through its HackerOne bug bounty program.
Public exploit details show attackers can upload a malicious DjVu file disguised as a JPG, causing GitLab to pass the file to ExifTool and trigger code execution through the related CVE-2021-22204 weakness. An Exploit Database proof of concept demonstrated successful exploitation against GitLab 13.10.1 and 13.10.2, producing a reverse shell as the git user without authentication or user interaction. GitLab fixed the issue in versions 13.10.3, 13.9.6, and 13.8.8.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2021-22205 was updated. The record continued to describe the GitLab CE/EE flaw as a critical remote code execution vulnerability.
Jacob Baines dated an Exploit Database proof of concept for unauthenticated remote code execution against vulnerable GitLab instances. The exploit used a crafted DjVu file disguised as a JPG to trigger code execution via ExifTool.
The CVE record for CVE-2021-22205 was published, documenting a critical unauthenticated remote code execution vulnerability in GitLab CE/EE. The flaw affected GitLab versions starting from 11.9, including versions before 13.8.8, 13.9.6, and 13.10.3.
A vendor advisory for the GitLab remote code execution issue was published. The issue affected GitLab CE/EE through improper validation of image files passed to a file parser.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab patched **CVE-2026-85706**, a CVSS 10.0 vulnerability in the repository commits API that lets unauthenticated remote attackers bypass path restrictions and read arbitrary files from vulnerable self-managed GitLab CE and EE servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog, while public proof-of-concept material, Nuclei templates, scanning, and attempted exploitation have increased the risk that exposed instances could leak secrets, CI/CD credentials, and deployment material. Organizations should urgently upgrade to GitLab versions **19.1.8**, **19.2.6**, or **19.3.2**, as applicable, and review API request logs for traversal attempts against commit endpoints. The releases also remediate critical flaws including **CVE-2026-87719**, an authenticated GitLab EE Duo Chat unsafe-deserialization issue, alongside other high-severity bugs that can enable remote code execution, configuration changes, CI/CD-variable access, denial of service, or GraphQL authorization and CSRF attacks; defenders should treat a GitLab compromise as a potential software supply-chain incident.
Sep 19, 2026
GitLab Community Edition (CE) and Enterprise Edition (EE) updates address seven vulnerabilities, including the critical path-traversal flaw **CVE-2026-85706** and two critical CI/CD code-execution vulnerabilities, **CVE-2026-89078** and **CVE-2026-93577**. CVE-2026-85706 has a CVSS score of 10.0 and allows an unauthenticated remote attacker to read arbitrary files through the repository commits API because of improper path confinement and missing authentication enforcement. FortiGuard reported exploitation attempts across multiple countries and sectors, while CISA added the flaw to its Known Exploited Vulnerabilities catalog. The two CVSS 9.9 CI/CD flaws can allow an authenticated user to execute arbitrary code on the GitLab server under certain conditions using specially crafted regular expressions in CI/CD configuration. Self-managed GitLab administrators should upgrade immediately: versions 19.2 should move to **19.2.7** or later, 19.3 to **19.3.3** or later, and 19.4 to **19.4.1** or later; earlier fixes for CVE-2026-85706 were released in 19.1.8, 19.2.6, and 19.3.2. Organizations should also review repository commits API logs for suspicious requests, particularly attempts to retrieve configuration or credential files.
Oct 1, 2026
GitLab disclosed and remediated three high-severity vulnerabilities in GitLab CE/EE that could be exploited by unauthenticated attackers under certain conditions. **CVE-2026-4922** is a cross-site request forgery flaw (`CWE-352`) that could let an attacker trigger GraphQL mutations as an authenticated user, while **CVE-2026-5262** is a cross-site scripting issue (`CWE-79`) that could expose tokens in the Storybook development environment. GitLab also fixed **CVE-2026-5816**, an improper path validation flaw (`CWE-41`) that could allow arbitrary JavaScript execution in a victim’s browser session. The issues affect multiple GitLab CE/EE release lines, with patched versions identified as **18.9.6**, **18.10.4**, and **18.11.1** depending on the flaw. CVE-2026-4922 affects versions from `17.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; CVE-2026-5262 affects versions from `16.1.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; and CVE-2026-5816 affects `18.10` before `18.10.4` and `18.11` before `18.11.1`. The vulnerabilities carry CVSS v3.1 ratings reflecting high confidentiality and integrity impact, and GitLab linked the disclosures to its patch release notice, internal work items, and HackerOne reports.
Jun 29, 2026