CVE-2022-32114
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
An unrestricted file upload vulnerability in Strapi 4.1.12's Add New Assets function allows XSS attacks via a crafted PDF file. The project documentation notes that users with Media Library upload permissions can upload PDFs containing JavaScript, and all files in the public assets folder are externally accessible.
Risk Assessment
An attacker can exploit this vulnerability to execute XSS scripts in a victim's browser, potentially leading to session theft, redirects, or other malicious actions within the Strapi application context.
Recommendation
It is recommended to restrict allowed file types to only images, video, and audio (excluding PDF) in Strapi configuration if not required, and to update to the latest Strapi version which may include security fixes.
Other vulnerabilities in Strapi
See all- CVE-2026-27886High
Strapi is an open-source content management system that in versions from 4.0.0 to prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter to perform a boolean-oracle attack against private fields in the `admin_users` table, allowing for administrative account takeover.
- CVE-2023-22894MediumActively exploited
Strapi through 4.5.5 allows attackers with admin panel access to discover sensitive user details by exploiting the query filter. Attackers can filter users by columns containing sensitive information and infer values from API responses. Super admin can discover password hashes and password reset tokens of all users.
- CVE-2026-108114Medium
Strapi versions 5.47.0 through 5.57.0 contain an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
- CVE-2026-90561High
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.
- CVE-2026-57997Medium
The Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
- CVE-2023-34235High
Strapi, an open-source content management system, prior to version 4.10.8, allows leaking private fields when using the `t(number)` prefix. Changing the prefix in Knex queries can expose protected data such as admin passwords.
- CVE-2023-34093Medium
Strapi, an open-source content management system, prior to version 4.10.8 allowed anyone to make content-type attributes public without realizing it. This vulnerability could lead to sensitive information being exposed as users might unknowingly remove the privateAttributes protection mechanism.
Original NVD description (English source)
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS