{"id":"CVE-2022-32114","aliases":["EUVD-2022-6232","GHSA-4vm8-j95f-j6v5"],"status":"disputed","title":"Strapi 4.1.12 Cross-site Scripting via crafted file","description":"An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library \"Create (upload)\" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01974,"percentile":0.80644,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434","CWE-79"],"published":"2022-07-13T00:00:00Z","modified":"2026-10-28T02:30:56Z","exploits":[{"source":"pocgithub","id":"bypazs/CVE-2022-32114","title":"bypazs/CVE-2022-32114","date":"2022-05-29","url":"https://github.com/bypazs/CVE-2022-32114"}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@strapi/strapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.12"}]}]},{"source":"osv","ecosystem":"npm","package":"@strapi/strapi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.1.12"}]}]}],"products":[{"vendor":"strapi","product":"strapi"}],"references":[{"url":"https://github.com/bypazs/strapi","tags":["x_transferred","Product","package","web"]},{"url":"https://grimthereaperteam.medium.com/strapi-v4-1-12-unrestricted-file-upload-b993bfd07e4e","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://docs.strapi.io/dev-docs/configurations/public-assets","tags":["x_transferred","web"]},{"url":"https://docs.strapi.io/user-docs/users-roles-permissions/configuring-administrator-roles","tags":["x_transferred","web"]},{"url":"https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/upload/admin/src/components/MediaLibraryInput/index.js#L33","tags":["x_transferred","web"]},{"url":"https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/content-type-builder/admin/src/components/AllowedTypesSelect/index.js#L14","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32114","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4vm8-j95f-j6v5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32114.json","tags":["advisory"]},{"url":"https://github.com/strapi/strapi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-32114","description":"An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library \"Create (upload)\" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.","status":"disputed","published":"2022-07-13T00:00:00Z","modified":"2025-02-13T16:32:42.016Z","updated_at":"2026-11-02T14:34:36.578327Z"}],"euvd":[{"id":"EUVD-2022-6232","description":"An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library \"Create (upload)\" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.","status":"published","published":"2022-07-13T00:00:00Z","modified":"2025-02-13T16:32:42Z","updated_at":"2026-11-03T00:03:52.752782Z"}],"ghsa":[{"id":"GHSA-4vm8-j95f-j6v5","title":"Strapi 4.1.12 Cross-site Scripting via crafted file","description":"An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to receive the XSS payload.","status":"published","published":"2022-07-14T00:00:16Z","modified":"2024-03-21T17:37:00Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-434"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2022-32114","description":"An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library \"Create (upload)\" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.","status":"disputed","published":"2022-07-13T21:15:08.083Z","modified":"2026-07-02T16:00:48.177Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:07:23.322724Z"}],"osv":[{"id":"GHSA-4vm8-j95f-j6v5","title":"Strapi 4.1.12 Cross-site Scripting via crafted file","description":"An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to receive the XSS payload.","status":"published","published":"2022-07-14T00:00:16Z","modified":"2024-03-21T17:36:58Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-434","CWE-79"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"CVE-2022-32114","description":"An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library \"Create (upload)\" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.","status":"published","published":"2022-07-13T00:00:00Z","modified":"2026-10-28T02:30:56.806563853Z","updated_at":"2026-11-02T15:44:25.860945Z"}]}}