Database Query Injection Vulnerability in Strapi Headless CMS
CVE-2026-22599
What is CVE-2026-22599?
Strapi, a popular open-source headless content management system (CMS), has a vulnerability in its Content-Type Builder API, allowing authenticated administrators to execute arbitrary database statements. This weakness arises from improper sanitization of the column.defaultTo attribute during schema migrations. As a result, attackers can exploit this to read files, cause denial of service, or potentially execute remote code on the database server, depending on the underlying database engine. The recent patches in versions 4.26.1 and 5.33.2 restrict vulnerable APIs to development mode, effectively mitigating the risk by eliminating network accessibility to specific endpoints.
Affected Version(s)
@strapi/content-type-builder >= 5.0.0, < 5.33.2 < 5.0.0, 5.33.2
@strapi/content-type-builder >= 4.0.0, < 4.26.1 < 4.0.0, 4.26.1
strapi >= 5.0.0, < 5.33.2 < 5.0.0, 5.33.2