CVE-2026-22599

CRITICAL EPSS 63.7%
Published May 14, 20261mo ago · Modified Jun 17, 20261w ago
9.3 CVSS 4.0
Critical
Find Similar
Published May 14, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely.

CVSS Details

Base Score
9.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
63.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 2

VendorProductVersionRange
strapistrapi*≥4.0.0  –  <4.26.1
strapistrapi*≥5.0.0  –  <5.33.2

References 3

  • github.com https://github.com/strapi/strapi/releases/tag/v4.26.1
    PatchProduct
  • github.com https://github.com/strapi/strapi/releases/tag/v5.33.2
    PatchProduct
  • github.com https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx
    Vendor Advisory

Remediation

  • github.com https://github.com/strapi/strapi/releases/tag/v4.26.1
    PatchProduct
  • github.com https://github.com/strapi/strapi/releases/tag/v5.33.2
    PatchProduct