CVE-2022-2185

Deeper analysis

A critical vulnerability tracked as CVE-2022-2185 affects GitLab Community and Enterprise Editions in all versions from 14.0 prior to 14.10.5, from 15.0 prior to 15.0.4, and from 15.1 prior to 15.1.1. The flaw, assigned CWE-78, permits an authenticated user who is authorized to import projects to supply a maliciously crafted project file that triggers remote code execution on the server. It carries a CVSS 3.1 base score of 9.9, reflecting network attack vector, low complexity, and full confidentiality, integrity, and availability impact under a changed scope.

An attacker with a low-privileged GitLab account that includes project-import rights can upload the crafted archive through the normal import workflow. Successful exploitation results in arbitrary command execution on the underlying GitLab host, potentially allowing the attacker to read or modify repositories, pivot within the instance, or fully compromise the server.

Official GitLab advisories and the associated security release notes direct administrators to upgrade immediately to 14.10.5, 15.0.4, or 15.1.1 or later, depending on the branch in use. The referenced CVE JSON and issue trackers confirm that the fixes address the unsafe handling of imported project data that led to the command-injection condition. The EPSS score has reached a peak of 0.9403 with a current value of 0.8696, indicating sustained exploitation interest after disclosure.