CVE-2026-22707

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions (`plugin.upload.security.allowedTypes` and `deniedTypes`). The same restrictions were correctly enforced on the Admin Panel upload path. The upload plugin's `enforceUploadSecurity` security check was invoked in the admin upload controller but was missing from the Content API controller. The Content API handlers `uploadFiles` and `replaceFile` (and the `upload` wrapper that dispatches to them) called the underlying upload service directly, bypassing both the magic-byte MIME detection and the configured allow/deny lists. An authenticated user with the Content API upload permission could therefore upload file types the administrator had explicitly disallowed, including HTML and SVG content. In deployments serving uploaded files from the same origin as the admin panel (default), an attacker could upload an HTML or SVG file that, when opened directly by an admin, executed JavaScript in the admin origin, enabling admin-session hijack and authenticated administrative actions against the admin API. The patch in version 5.33.3 introduces a shared `prepareUploadRequest` helper that wraps `enforceUploadSecurity` and is called from both the Content API and admin upload controllers, ensuring identical security policy enforcement on every upload entry point.

• CWE-434
• CWE-693

• https://github.com/strapi/strapi/security/advisories/GHSA-pcw7-5633-82vvVendor Advisory

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22701filelock is a platform-independent file lock for Python. Pri…5.3
• CVE-2026-22702virtualenv is a tool for creating isolated virtual python en…4.5
• CVE-2026-22703Cosign provides code signing and transparency for containers…5.5
• CVE-2026-22704HAX CMS helps manage microsite universe with PHP or NodeJs b…5.4
• CVE-2026-22705RustCrypto: Signatures offers support for digital signatures…6.4
• CVE-2026-22706Strapi is an open source headless content management system.…6.5
• CVE-2026-22708Cursor is a code editor built for programming with AI. Prior…9.8
• CVE-2026-22709vm2 is an open source vm/sandbox for Node.js. In vm2 prior t…10
• CVE-2026-2271A flaw was found in GIMP's PSP (Paint Shop Pro) file parser.…5.5
• CVE-2026-22710Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-22711Improper neutralization of alternate XSS syntax vulnerabilit…6.9
• CVE-2026-22712Improper Encoding or Escaping of Output due to magic word re…4.3