Action needed by self-managed customers in response to CVE-2021-22205

This post details a critical vulnerability (CVE-2021-22205) in a third-party Exif-Tool parser used by GitLab, which allows for remote command execution. It affects specific self-managed versions (11.9.x - 13.8.7, 13.9.0 - 13.9.5, 13.10.0 - 13.10.2) and has been confirmed to be exploited. Customers are urged to upgrade to patched versions (13.10.3, 13.9.6, 13.8.8 or later) or apply a hotpatch. GitLab.com users are not affected. It also provides guidance on how to determine if an instance has been compromised and directs users to security alerts.