PT-2026-40834 · Strapi · @Strapi/Content-Type-Builder+1

Whiteov3Rflow

·

Published

2026-05-13

·

Updated

2026-05-18

·

CVE-2026-22599

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Name of the Vulnerable Software and Affected Versions Strapi versions 4.0.0 through 4.26.0 Strapi versions 5.0.0 through 5.33.1
Description A database-query injection exists in the Content-Type Builder write API. An authenticated administrator can inject arbitrary database statements through the column.defaultTo attribute during the creation or modification of a content type. By setting defaultTo as a tuple [value, { isRaw: true }], the value is passed directly into the db.connection.raw() function of Knex without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine used, this can lead to arbitrary file reads via database utility functions, denial of service through forced server crashes during schema migration, or remote code execution against the database server on engines that permit external program execution. The issue affects the '/content-type-builder/content-types' endpoint and related write APIs.
Recommendations Update versions 4.0.0 through 4.26.0 to 4.26.1. Update versions 5.0.0 through 5.33.1 to 5.33.2. Restrict access to the '/content-type-builder/content-types' endpoint and related write APIs to development mode only.

Fix

DoS

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-22599
GHSA-3XCQ-8MJW-H6MX

Affected Products

@Strapi/Content-Type-Builder
@Strapi/Plugin-Content-Type-Builder