References https://avd.aliyun.com/detail?id=AVD-2022-2185 https://starlabs.sg/blog/2022/07-gitlab-project-import-rce-analysis-cve-2022-2185/ https://cloud.tencent.com/developer/article/2551220 https://gitlab.com/gitlab-org/gitlab/-/issues/366088 https://nvd.nist.gov/vuln/detail/CVE-2022-2185 https://blog.csdn.net/cups107/article/details/126501687 https://github.com/Cryin/Paper/blob/master/Gitlab%20Projects%20Import%20RCE%20Analysis.md https://nosec.org/m/share/5023.html
Related VulnerabilitiesPoCCVE-2026-85706: GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File ReadGitLab CE/EE /api/graphql 未授权访问漏洞(CVE-2026-19478)PoCCVE-2026-19478: GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method InvocationPoCclaude-settings-exposure: Claude Code Project Settings Exposure鸿翼文档管理系统 importNewBpmnDesignByIe 代码执行漏洞北京中科聚网一体化运营平台 /manage/tplresource/importVisualModuleImg 文件上传漏洞关于用友GRP-U8Cloud产品getBudgetReleaseProjectList及U8AppProxy及fbpm-modeler存在命令执行漏洞的安全通告FOGProject /fog/management/export.php 信息泄露漏洞(CVE-2025-58443)PoCCVE-2026-47717: FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data DisclosurePoCCVE-2026-47670: DbGate - Remote Code Execution via Dynamic Import BypassTRUfusion Enterprise /trufusionPortal/getProjectList 权限绕过漏洞(CVE-2025-27223)FUXA /api/project 信息泄露漏洞(CVE-2026-47717)东胜物流软件 /Import/ImportTrade/DeleteWMS SQL 注入漏洞