CVE-2021-22234

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server.

• CWE-79

• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22234.jsonVendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/335205Issue Tracking, Vendor Advisory
• https://hackerone.com/reports/1212067Exploit, Issue Tracking, Third Party Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22234.jsonVendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/335205Issue Tracking, Vendor Advisory
• https://hackerone.com/reports/1212067Exploit, Issue Tracking, Third Party Advisory

Published

Aug 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22229An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2021-2223Vulnerability in the Oracle Receivables product of Oracle E-…8.1
• CVE-2021-22230Improper code rendering while rendering merge requests could…7.2
• CVE-2021-22231A denial of service in user's profile page is found starting…4.3
• CVE-2021-22232HTML injection was possible via the full name field before v…5.4
• CVE-2021-22233An information disclosure vulnerability in GitLab EE version…4.3
• CVE-2021-22235Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0…7.5
• CVE-2021-22236Due to improper handling of OAuth client IDs, new subscripti…8.8
• CVE-2021-22237Under specialized conditions, GitLab may allow a user with a…4.9
• CVE-2021-22238An issue has been discovered in GitLab affecting all version…5.4
• CVE-2021-22239An unauthorized user was able to insert metadata when creati…4.3
• CVE-2021-2224Vulnerability in the Oracle Compensation Workbench product o…8.1