CVE-2022-32114

An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.

• CWE-434

• https://docs.strapi.io/dev-docs/configurations/public-assets
• https://docs.strapi.io/user-docs/users-roles-permissions/configuring-administrator-roles
• https://github.com/bypazs/strapiProduct
• https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/content-type-builder/admin/src/components/AllowedTypesSelect/index.js#L14
• https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/upload/admin/src/components/MediaLibraryInput/index.js#L33
• https://grimthereaperteam.medium.com/strapi-v4-1-12-unrestricted-file-upload-b993bfd07e4eExploit, Third Party Advisory
• https://docs.strapi.io/dev-docs/configurations/public-assets
• https://docs.strapi.io/user-docs/users-roles-permissions/configuring-administrator-roles
• https://github.com/bypazs/strapiProduct
• https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/content-type-builder/admin/src/components/AllowedTypesSelect/index.js#L14
• https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/upload/admin/src/components/MediaLibraryInput/index.js#L33
• https://grimthereaperteam.medium.com/strapi-v4-1-12-unrestricted-file-upload-b993bfd07e4eExploit, Third Party Advisory

Published

Jul 13, 2022

Last Modified

Jul 2, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32094Hospital Management System v1.0 was discovered to contain a …9.8
• CVE-2022-32095Hospital Management System v1.0 was discovered to contain a …9.8
• CVE-2022-32096Rhonabwy before v1.1.5 was discovered to contain a buffer ov…7.5
• CVE-2022-3210This vulnerability allows network-adjacent attackers to exec…8.8
• CVE-2022-32101kkcms v1.3.7 was discovered to contain a SQL injection vulne…9.8
• CVE-2022-3211Cross-site Scripting (XSS) - Stored in GitHub repository pim…5.4
• CVE-2022-32115An issue in the isSVG() function of Known v1.2.2+2020061101 …6.1
• CVE-2022-32117Jerryscript v2.4.0 was discovered to contain a stack buffer …7.8
• CVE-2022-32118Arox School ERP Pro v1.0 was discovered to contain a cross-s…6.1
• CVE-2022-32119Arox School ERP Pro v1.0 was discovered to contain multiple …8.8
• CVE-2022-3212<bytes::Bytes as axum_core::extract::FromRequest>::from_requ…7.5
• CVE-2022-3212474cmsSE v3.5.1 was discovered to contain a reflective cross-…6.1