Strapi

41 CVEs across 7 Strapi products. Browse Strapi vulnerabilities, severities, and proof-of-concept exploits.

Strapi products with known CVEs

ProductCVEs
Strapi40
@Strapi/plugin-Users-Permissions2
Protected Populate1
@Strapi/admin1
@Strapi/content-Type-Builder1
Strapi/strapi1
@Strapi/upload1
Strapi CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-57997Medium4.82026-06-29Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance…
CVE-2026-27886High7.52026-05-14Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query paramete…
CVE-2026-22707Medium5.42026-05-14Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the…
CVE-2026-22706Medium6.52026-05-14Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the…
CVE-2026-22599High7.22026-05-14Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-qu…
CVE-2025-64526Medium5.32026-05-14Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin deri…
CVE-2025-53092Medium6.52025-10-16Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installat…
CVE-2025-25298Medium5.32025-10-16Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for passwo…
CVE-2024-56143High8.22025-10-16Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does…
CVE-2025-39302025-10-16Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen…
CVE-2024-52588Medium4.92025-05-29Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetc…
CVE-2024-37818High8.62024-06-20Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to…
CVE-2024-34065High7.12024-06-12Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @s…
CVE-2024-31217Medium5.32024-06-12Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing t…
CVE-2024-29181Low2.32024-06-12Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an assoc…
CVE-2023-48218Medium5.32023-11-20The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field…
CVE-2023-39345High7.62023-11-06strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration en…
CVE-2023-38507High7.32023-09-15Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen…
CVE-2023-37263Medium6.82023-09-15Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title…
CVE-2023-36472Medium5.82023-09-15Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if the…
CVE-2023-34235High8.62023-07-25Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` pre…
CVE-2023-34093Medium4.82023-07-25Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a…
CVE-2023-22894Medium4.92023-04-19Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filt…
CVE-2023-22893High7.52023-04-19Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A rem…
CVE-2023-22621High7.22023-04-19Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacke…
CVE-2022-31367High8.82022-09-27Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
CVE-2022-32114High8.82022-07-13An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE…
CVE-2022-29894Medium4.82022-06-13Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary…
CVE-2022-30618High7.52022-05-19An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if cont…
CVE-2022-30617High8.82022-05-19An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel…
CVE-2021-46440High7.52022-05-03Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a vict…
CVE-2022-27263Critical9.82022-04-12An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-0764Medium6.72022-02-26Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.
CVE-2021-28128High8.12021-05-06In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a val…
CVE-2020-27666Medium5.42020-10-22Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.
CVE-2020-27665High7.52020-10-22In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.
CVE-2020-27664Critical9.82020-10-22admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
CVE-2020-13961Medium6.52020-06-19Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any s…
CVE-2020-8123Medium4.92020-02-04A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of t…
CVE-2019-19609High7.22019-12-05The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because i…
CVE-2019-18818Critical9.82019-11-07strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controll…