onyx --cves cve-2021-22205

CVE-2021-22205

score: <0.1
cvss: —
epss: 99.7%
published: —
kev added: 2021-11-03
first seen: 2026-10-21

GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2021-11-03 Added to CISA KEV
2026-10-08 First advisory — CISA Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
by 2026-10-21 Tracked by Onyx
by 2026-10-21 Nuclei template GitLab CE/EE - Remote Code Execution

Nuclei template

A verified check exists — you can scan for this today, and so can everyone else.

template: GitLab CE/EE - Remote Code Execution
github: projectdiscovery/nuclei-templates/http/cves/2021/CVE-2021-22205.yaml ↗
severity: CRIT
first seen: 2026-10-21

$ nuclei -id CVE-2021-22205 -u https://target.example

Advisories

0 feeds this week

ADV Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data CISA · 2026-10-08

Weaknesses

CWE-20 CWE-95

References 1

https://nvd.nist.gov/vuln/detail/CVE-2021-22205