CVE-2022-32114
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
An unrestricted file upload vulnerability in Strapi 4.1.12's Add New Assets function allows XSS attacks via a crafted PDF file. The project documentation notes that users with Media Library upload permissions can upload PDFs containing JavaScript, and all files in the public assets folder are externally accessible.
Risk Assessment
An attacker can exploit this vulnerability to execute XSS scripts in a victim's browser, potentially leading to session theft, redirects, or other malicious actions within the Strapi application context.
Recommendation
It is recommended to restrict allowed file types to only images, video, and audio (excluding PDF) in Strapi configuration if not required, and to update to the latest Strapi version which may include security fixes.
Other vulnerabilities in Strapi
See all- CVE-2026-27886High
Strapi is an open-source content management system that in versions from 4.0.0 to prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter to perform a boolean-oracle attack against private fields in the `admin_users` table, allowing for administrative account takeover.
- CVE-2026-57997Medium
The Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
- CVE-2023-34235High
Strapi, an open-source content management system, prior to version 4.10.8, allows leaking private fields when using the `t(number)` prefix. Changing the prefix in Knex queries can expose protected data such as admin passwords.
- CVE-2023-34093Medium
Strapi, an open-source content management system, prior to version 4.10.8 allowed anyone to make content-type attributes public without realizing it. This vulnerability could lead to sensitive information being exposed as users might unknowingly remove the privateAttributes protection mechanism.
Original NVD description (English source)
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.