CVE-2021-22201: 
GitLab vulnerability analysis and mitigation

A critical security vulnerability (CVE-2021-22201) was discovered in GitLab CE/EE affecting all versions starting from 13.9. The vulnerability allowed attackers to read files on the server through a specially crafted import file. The issue was discovered and disclosed in March 2021, with patches released on March 31, 2021 (GitLab Release).

The vulnerability was assessed as critical severity with a CVSS score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The issue specifically involved the project import functionality where a maliciously crafted import file could be used to read files on the server (GitLab Release).

The vulnerability allowed attackers with low privileges to read and potentially access sensitive files on the server, potentially leading to unauthorized access to confidential information and system files (GitLab Release).

The vulnerability was discovered through GitLab's bug bounty program on HackerOne by researcher 'saltyyolk'. The low complexity of exploitation (AC:L) and the requirement of only low privileges (PR:L) made this vulnerability particularly concerning (GitLab Release).

GitLab addressed this vulnerability by releasing security patches in versions 13.10.1, 13.9.5, and 13.8.7 for both Community Edition (CE) and Enterprise Edition (EE). Users were strongly recommended to upgrade their GitLab installations to one of these patched versions immediately (GitLab Release).