CVE-2024-31217

Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it's manually restarted. Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well. Users should upgrade @strapi/plugin-upload to version 4.22.0 to receive a patch.

• CWE-248

• https://github.com/strapi/strapi/commit/a0da7e73e1496d835fe71a2febb14f70170135c7Patch
• https://github.com/strapi/strapi/security/advisories/GHSA-pm9q-xj9p-96pmExploit, Vendor Advisory
• https://github.com/strapi/strapi/commit/a0da7e73e1496d835fe71a2febb14f70170135c7Patch
• https://github.com/strapi/strapi/security/advisories/GHSA-pm9q-xj9p-96pmExploit, Vendor Advisory

Published

Jun 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31211WordPress is an open publishing platform for the Web. Unseri…9.8
• CVE-2024-31212InstantCMS is a free and open source content management syst…7.2
• CVE-2024-31213InstantCMS is a free and open source content management syst…5.4
• CVE-2024-31214Traccar is an open source GPS tracking system. Traccar versi…9.6
• CVE-2024-31215Mobile Security Framework (MobSF) is a security research pla…4.3
• CVE-2024-31216The source-controller is a Kubernetes operator, specialised …5.1
• CVE-2024-31218Webhood is a self-hosted URL scanner used analyzing phishing…9.8
• CVE-2024-31219Discourse-reactions is a plugin that allows user to add thei…4.3
• CVE-2024-3122CHANGING Mobile One Time Password does not properly filter p…4.9
• CVE-2024-31220Sunshine is a self-hosted game stream host for Moonlight. St…7.3
• CVE-2024-31221Sunshine is a self-hosted game stream host for Moonlight. St…5.9
• CVE-2024-31223Fides is an open-source privacy engineering platform, and `S…5.3