CVE-2021-22204
6.8
MEDIUM
CVSS 3.1
EPSS 100.0% · 100th pctCISA KEV · Exploited in the wild
2021-04-23•Updated 2025-10-21•KEV 2021-11-17
CISA Known Exploited Vulnerabilities
ExifTool Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Added to KEV
2021-11-17
Remediation due
2021-12-01
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-22204
Description
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Severity
CVSS 3.1 · CNA6.8 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:LSSVC · CISA-ADP
Exploitationactive
Automatableno
Technical impactpartial
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| ExifTool | ExifTool | >=7.44, <12.24 |
References
14 LinksMailing lists
- [oss-security] 20210509 [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image
- [oss-security] 20210510 Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image
- [debian-lts-announce] 20210516 [SECURITY] [DLA 2663-1] libimage-exiftool-perl security update
Other references
- https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800
- https://hackerone.com/reports/1154542
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json
- http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html
Record Details
Published
2021-04-23
Last updated
2025-10-21
Assigner (CNA)
GitLab
Credited to
Thanks vakzz for reporting this vulnerability through the GitLab HackerOne bug bounty program who then reported it to the ExifTool maintainer
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.