strapi has 8 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 5 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 4. The median CVSS is 5.3 (medium). 13% have been exploited in the wild — well above the 1% corpus average, so strapi flaws are worth patching on sight. Most affected products: strapi (5), Strapi Open Source and Enterprise Headless CMS (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 13% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —(1)
- Last 90 days
- 5 prev 1
Products
- strapi 5
- Strapi Open Source and Enterprise Headless CMS 3
Worst active — by depth score
CVE-2022-32114High· 8.8An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file61CVE-2023-22894Medium· 4.9Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter53CVE-2026-90561High· 8.7Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text48CVE-2026-108114Medium· 4.3Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted36CVE-2025-64526Medium· 5.3Strapi is an open source headless content management system29
strapi vulnerabilities
CVEs affecting strapi, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-118170NoneCVE-2026-118170
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
CVE-2026-118172NoneCVE-2026-118172
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC19…
CVE-2026-118171NoneCVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permis…
CVE-2026-108114Medium· 4.3PoCStrapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeil…
CVE-2026-90561High· 8.7Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store m…
CVE-2025-64526Medium· 5.3Strapi is an open source headless content management system
Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on rou…
CVE-2023-22894Medium· 4.9CISA KEVPoC⚖ disputedStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from …
CVE-2022-32114High· 8.8PoCAn unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create…