ExifTool DjVu File Parsing Arbitrary Code Execution Vulnerability (CVE-2021-22204) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTExifTool versions 7.44 up to 12.24, and third-party integrations such as GitLab that utilize ExifTool for metadata parsing
Unauthenticated remote attackers can execute arbitrary commands on the host system by uploading a specially crafted DjVu image
Immediately upgrade ExifTool to version 12.24 or higher, and update GitLab instances to 13.10.3, 13.9.6, 13.8.8, or newer
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade ExifTool to the latest patched version (12.24+) or update your GitLab instance immediately using the package manager.
# Upgrade ExifTool on Debian/Ubuntu systems
sudo apt-get update && sudo apt-get install --only-upgrade libimage-exiftool-perl -y
# Upgrade GitLab Omnibus package to the latest secure version
sudo apt-get update && sudo apt-get install --only-upgrade gitlab-ee -y2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, block DjVu file uploads at the reverse proxy or Web Application Firewall (WAF).
# Block access to DjVu files in Nginx configuration
# Add this block inside your server configuration
location ~* \.(djvu|djv)$ {
deny all;
access_log off;
log_not_found off;
}3. Log Audit & IoC Verification Commands
Verify the installed ExifTool version and scan uploaded files for potential Perl injection payloads.
# Check the current ExifTool version
exiftool -ver
# Scan uploaded directories for suspicious Perl execution patterns in files
find /var/opt/gitlab/gitlab-rails/uploads/ -type f -exec grep -l 'eval' {} \;Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-22204) is an arbitrary code execution flaw in ExifTool, a widely used open-source library for reading and writing image/document metadata. The root cause lies in the improper neutralization of user-supplied data within the DjVu file format parser. Specifically, when processing the metadata inside the DjVu ANT (Annotation) chunk, ExifTool fails to properly sanitize input before passing it to a Perl 'eval'-like statement, allowing arbitrary Perl code execution.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious DjVu file containing payload-carrying Perl code inside the metadata annotation block. When ExifTool parses this file, the parser attempts to handle double-quoted strings but fails to correctly escape control characters. This allows the attacker to break out of the string context and inject arbitrary Perl syntax. In a real-world scenario, such as in GitLab, this vulnerability was chained with unauthenticated file upload endpoints, allowing remote attackers to achieve full Remote Code Execution (RCE) without any credentials.
3. Infrastructure & Business Impact
Given its inclusion in the CISA KEV list and an EPSS score of 0.9998, this vulnerability has been heavily exploited in the wild. Compromising developer infrastructure like GitLab can lead to catastrophic supply chain attacks, source code theft, lateral movement within internal networks, and deployment of ransomware, posing an existential threat to enterprise operations.
Official Vendor Advisories & References
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Frequently Asked SecOps Questions (CVE-2021-22204)
FAQQ1. How critical is CVE-2021-22204 and is it actively exploited in the wild?
CVE-2021-22204 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-22204?
Primary impacted vendors include exiftool, gitlab across exiftool, gitlab_enterprise_edition, gitlab_community_edition. Scope summary: ExifTool versions 7.44 through 12.23, and GitLab versions 11.9.0 through 13.10.2
Q3. What temporary mitigations or workarounds exist for CVE-2021-22204 before patching?
[Mitigation] Immediately upgrade ExifTool to version 12.24 or higher, and update GitLab instances to 13.10.3, 13.9.6, 13.8.8, or newer Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-22204
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (exiftool)
View Category →GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Gitea Remote Code Execution Vulnerability via diffpatch API and Git Hooks (CVE-2026-60004)
[Affected Scope] Gitea versions prior to 1.27.1
PostyBirb Plus Cross-Site Scripting (XSS) Vulnerability (CVE-2026-120190) Security Advisory
[Affected Scope] PostyBirb Plus versions up to and including 3.1.75
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.