PT-2026-40780 · Strapi · @Strapi/Upload

Arkmarta + 1 · Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-22707

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions @strapi/upload versions prior to 5.33.3

Description In the Upload plugin, Content API endpoints failed to enforce administrator-configured MIME type restrictions defined in plugin.upload.security.allowedTypes and deniedTypes. While these restrictions were active for the Admin Panel, the enforceUploadSecurity security check was missing from the Content API controller. Consequently, the uploadFiles and replaceFile handlers, as well as the upload wrapper, bypassed MIME detection and allow/deny lists.

An authenticated user with Content API upload permissions could upload disallowed file types, such as HTML and SVG. If uploaded files are served from the same origin as the admin panel, an attacker could upload a malicious HTML or SVG file. When opened by an administrator, this file could execute JavaScript within the admin origin, potentially leading to admin-session hijacking and unauthorized administrative actions via the admin API.

Recommendations Update @strapi/upload to version 5.33.3 or later.

Fix

Protection Mechanism Failure

Unrestricted File Upload

Weakness Enumeration

CWE-693

CWE-434

Related Identifiers

CVE-2026-22707

GHSA-PCW7-5633-82VV

Affected Products

@Strapi/Upload

References · 5

• https://github.com/strapi/strapi/security/advisories/GHSA-pcw7-5633-82vv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22707 · Security Note
• https://osv.dev/vulnerability/GHSA-pcw7-5633-82vv · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://twitter.com/kaminuma_dev/status/2054575904152838411 · Twitter Post