CVE-2021-22204

Confirmed PUBLISHED

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the...

ExifTool · ExifTool

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

6.8 Medium

At a Glance

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

metasploit cisa

CVE Published: Apr 23, 2021
Exploitation Reported: Nov 17, 2021
CVSS: 6.8 Medium
EPSS: —

Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
ExifTool	ExifTool	>=7.44, <12.24	Affected

CVE References

DSA-4910 debian.org · Vendor Advisory https://www.debian.org/security/2021/dsa-4910
FEDORA-2021-de850ed71e lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
FEDORA-2021-e3d8833d36 lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
FEDORA-2021-88d24aa32b lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
[oss-security] 20210509 [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/05/09/1

Show 9 more references

[oss-security] 20210510 Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/05/10/5
[debian-lts-announce] 20210516 [SECURITY] [DLA 2663-1] libimage-exiftool-perl security update lists.debian.org · Mailing List https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html
GitHub — exiftool/exiftool github.com · CVE Record https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd11...
hackerone.com/reports/1154542 hackerone.com · CVE Record https://hackerone.com/reports/1154542
gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-... gitlab.com · CVE Record https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204....
packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injectio... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-In...
packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-E... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Re...
packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Exec... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Cod...
packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-E... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-17 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_exif_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 6.8 Medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Exploitation Status

Exploited in the wild

Recorded 2021-11-17 00:00:00 UTC · CISA

Proof of concept available

Recorded 2021-05-11 18:45:07 UTC · GitHub

Weaknesses (CWE)

CWE-94

Improper Control of Generation of Code ('Code Injection')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_exif_rce.rb	Apr 28, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Akash7350/CVE-2021-22204

github · Created 2023-05-14 03:43:28 UTC · 4 stars

UNICORDev/exploit-CVE-2021-22204

github · Created 2022-04-16 22:49:47 UTC · 41 stars

Exploit for CVE-2021-22204 (ExifTool) - Arbitrary Code Execution

mr-tuhin/CVE-2021-22204-exiftool

github · Created 2022-02-21 11:07:19 UTC · 8 stars

exiftool exploit

0xBruno/CVE-2021-22204

github · Created 2022-01-30 03:11:56 UTC · 2 stars

A complete PoC for CVE-2021-22204 exiftool RCE

trganda/CVE-2021-22204

github · Created 2021-12-29 13:41:35 UTC · 3 stars

ph-arm/CVE-2021-22204-Gitlab

github · Created 2021-11-04 14:31:02 UTC · 2 stars

Modification of gitlab exploit anything under 13.10

AssassinUKG/CVE-2021-22204

github · Created 2021-08-02 18:56:16 UTC · 27 stars

PenTestical/CVE-2021-22204

github · Created 2021-08-02 09:11:27 UTC · 3 stars

bilkoh/POC-CVE-2021-22204

github · Created 2021-05-21 00:14:52 UTC · 8 stars

POC for exiftool vuln (CVE-2021-22204).

se162xg/CVE-2021-22204

github · Created 2021-05-12 08:51:44 UTC · 11 stars

exiftool arbitrary code execution vulnerability

convisolabs/CVE-2021-22204-exiftool

github · Created 2021-05-11 18:45:07 UTC · 93 stars

Python exploit for the CVE-2021-22204 vulnerability in Exiftool

gitlab_exif_rce

metasploit · Created Unknown

Metasploit module for CVE-2021-22204

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-22204

{
  "cve_id": "CVE-2021-22204",
  "title": "Improper neutralization of user data in the DjVu file format in ExifTool vers...",
  "affected_vendor": "ExifTool",
  "affected_product": "ExifTool",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 6.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-22204

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API