ST
Product
strapi
On CISA KEVExploited in the wild
41
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 4High 20Medium 15Low 2
Watch
Add strapi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-22894 In wildKEV | 4.9 | Apr 19 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter Affected: 3.2.1 before 4.8.0 |
| CVE-2023-38507 | 9.8 | Sep 15 | Strapi is the an open-source headless content management system Affected: before 4.12.1 |
| CVE-2022-27263 | 9.8 | Apr 12 | An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file Affected: 4.1.5 |
| CVE-2020-27664 | 9.8 | Oct 22 | admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality Affected: before 3.2.5 |
| CVE-2019-18818 | 9.8 | Nov 7 | strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js Affected: through 1.6.4; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2022-31367 | 8.8 | Sep 27 | Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses Affected: before 3.6.10; 4.0.0 before 4.1.10 |
| CVE-2022-32114 | 8.8 | Jul 13 | An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file Affected: 4.1.12 |
| CVE-2022-30617 | 8.8 | May 19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a… Affected: 3.0.0 before 3.6.10; 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +9 more |
| CVE-2026-90561 | 8.7 | Sep 13 | Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG Affected: 4.0.0 through 4.26.2; 5.0.0 before 5.48.1 |
| CVE-2024-37818 | 8.6 | Jun 20 | Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image Affected: 4.24.4 |
| CVE-2024-56143 | 8.2 | Oct 16 | Strapi is an open-source headless content management system Affected: 5.0.0 before 5.5.2 |
| CVE-2024-34065 | 8.1 | Jun 12 | Strapi is an open-source content management system Affected: before 4.24.2 |
| CVE-2021-28128 | 8.1 | May 6 | In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password Affected: through 3.6.0 |
| CVE-2026-27886 | 7.5 | May 14 | Strapi may leak sensitive data via relational filtering due to lack of query sanitization Affected: >= 4.0.0, < 5.37.0 |
| CVE-2024-52588 | 7.5 | May 29 | Strapi is an open-source content management system Affected: before 4.25.2 |
| CVE-2023-39345 | 7.5 | Nov 6 | strapi is an open-source headless CMS Affected: 4.0.0 before 4.13.1 |
| CVE-2023-34235 | 7.5 | Jul 25 | Strapi is an open-source headless content management system Affected: before 4.10.8 |
| CVE-2023-22893 | 7.5 | Apr 19 | Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication Affected: 3.0.0 before 4.6.0 |
| CVE-2022-30618 | 7.5 | May 19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible… Affected: 3.0.0 before 3.6.10; 4.0.0 before 4.1.10 |
| CVE-2021-46440 | 7.5 | May 3 | Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request,… Affected: before 3.6.9; 4.0.0 before 4.1.5 |
| CVE-2020-27665 | 7.5 | Oct 22 | In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes Affected: before 3.2.5 |
| CVE-2026-22599 | 7.2 | May 14 | Strapi Vulnerable to SQL Injection in Content Type Builder Affected: >= 5.0.0, < 5.33.2; >= 4.0.0, < 4.26.1 |
| CVE-2023-22621 | 7.2 | Apr 19 | Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server Affected: 3.0.0 before 4.5.6 |
| CVE-2019-19609 | 7.2 | Dec 5 | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize… Affected: through 1.6.4; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2023-34093 | 7.1 | Jul 25 | Strapi is an open-source headless content management system Affected: before 4.10.8 |
| CVE-2022-0764 | 6.7 | Feb 26 | Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0 Affected: before 4.1.0 |
| CVE-2026-22706 | 6.5 | May 14 | Strapi: Password Reset Does Not Revoke Existing Refresh Sessions Affected: < 5.33.3 |
| CVE-2025-53092 | 6.5 | Oct 16 | Strapi is an open source headless content management system Affected: before 5.20.0 |
| CVE-2024-31217 | 6.5 | Jun 12 | Strapi is an open-source content management system Affected: before 4.22.0 |
| CVE-2020-13961 | 6.5 | Jun 19 | Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation Affected: before 3.0.2 |
| CVE-2023-36472 | 5.7 | Sep 15 | Strapi is an open-source headless content management system Affected: before 4.11.7 |
| CVE-2026-57997 | 5.4 | Jun 29 | Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration Affected: before 5.7.0 |
| CVE-2026-22707 | 5.4 | May 14 | Strapi Upload Plugin MIME Validation Bypass via Content API Affected: < 5.33.3 |
| CVE-2020-27666 | 5.4 | Oct 22 | Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature Affected: before 3.2.5 |
| CVE-2025-64526 | 5.3 | May 14 | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying Affected: < 5.45.0 |
| CVE-2025-25298 | 5.3 | Oct 16 | Strapi is an open source headless CMS Affected: before 5.10.3 |
| CVE-2020-8123 | 4.9 | Feb 4 | A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application Affected: before 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2022-29894 | 4.8 | Jun 13 | Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function Affected: through 3.6.10 |
| CVE-2026-108114 | 4.3 | Oct 10 | Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions Affected: 5.47.0 through 5.57.0 |
| CVE-2024-29181 | 3.5 | Jun 12 | Strapi is an open-source content management system Affected: before 4.19.1 |
| CVE-2023-37263 | 2.7 | Sep 15 | Strapi is the an open-source headless content management system Affected: before 4.12.1 |
Showing 41