Strapi
Vulnerability activity for Strapi: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 5
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 90 days
- CVEs
- 6
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 365 days
- CVEs
- 12
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 2
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
Recent
- 6.1MediumOct 27, 2026Strapi Open Source and Enterprise Headless CMS SSRFCVE-2026-118172The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
- 6.5MediumOct 27, 2026Strapi Open Source and Enterprise Headless CMS Auth bypass / access controlCVE-2026-118171The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
- 9.1CriticalOct 27, 2026Strapi Open Source and Enterprise Headless CMS Auth bypass / access controlCVE-2026-118170The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
- 4.3MediumOct 10, 2026strapi Auth bypass / access controlCVE-2026-108114Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
- 7.2HighOct 8, 2026Strapi Information disclosureCVE-2023-22894Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Exploited3.6% likelyExploit code
- 8.7HighSep 13, 2026strapi XSSCVE-2026-90561Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.
- 4.8MediumJun 29, 2026strapi Crypto / certificateCVE-2026-57997Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
- 7.5HighMay 14, 2026strapi Path traversal / file handlingCVE-2026-27886Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter on any publicly-accessible content-type with an `updatedBy` (or other admin-relation) field to perform a boolean-oracle attack against private fields on the joined `admin_users` table, including the `resetPasswordToken` field.NucleiDetection
- 5.4MediumMay 14, 2026strapi Path traversal / file handlingCVE-2026-22707Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions (`plugin.upload.security.allowedTypes` and `deniedTypes`). The same restrictions were correctly enforced on the Admin Panel upload path. The upload plugin's `enforceUploadSecurity` security check was invoked in the admin upload controller but was missing from the Content API controller. The C
- 6.5MediumMay 14, 2026strapiCVE-2026-22706Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An a
- 7.2HighMay 14, 2026strapi SQL injectionCVE-2026-22599Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into
- 5.3MediumMay 14, 2026strapiCVE-2025-64526Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on routes whose body schema does not contain an `email` field (`/auth/local`, `/auth/reset-password`, `/auth/change-password`). An unauthenticated attacker could include an arbitrary `email` value in the request body to obtain a fresh rate-limit key per request, effect
Top products
- Strapi9 CVEs in the last year, 1 exploited
- Strapi Open Source and Enterprise Headless CMS3 CVEs in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.