← Back to CVE Explorer

CVE-2026-22599

Full vulnerability record from the local CVENow database.

Description

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely.

Severity
CRITICAL
CVSS score
9.3 (v4.0)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2026-05-14 19:16:29.650000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON 
{
  "id": "CVE-2026-22599",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-14T19:16:29.650",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely."
    },
    {
      "lang": "es",
      "value": "Strapi es un sistema de gestión de contenido headless de código abierto. En versiones de la rama 4.x anteriores a la 4.26.1 y de la rama 5.x anteriores a la 5.33.2, existía una vulnerabilidad de inyección de consultas de base de datos en la API de escritura del Content-Type Builder de Strapi. Un administrador autenticado podía inyectar sentencias de base de datos arbitrarias a través del atributo ’column.defaultTo’ al crear o modificar un tipo de contenido. Establecer ’defaultTo’ como una tupla ’[value, { isRaw: true }]’ hacía que el valor se pasara directamente a ’db.connection.raw()’ de Knex durante la migración del esquema sin sanitización, permitiendo la ejecución de sentencias arbitrarias en la capa de base de datos. Dependiendo del motor de base de datos, esto permitía la lectura arbitraria de archivos a través de funciones de utilidad de base de datos, la denegación de servicio a través de un fallo forzado del servidor por error de migración de esquema, y en motores que permiten la ejecución de programas externos, la ejecución remota de código contra el servidor de base de datos. El parche en las versiones 4.26.1 y 5.33.2 aborda esto restringiendo todas las APIs de escritura del Content-Type Builder solo al modo de desarrollo. Las implementaciones de producción que ejecutan la v5.33.2 o posterior devuelven 404 para las solicitudes contra ’/content-type-builder/content-types’ y los puntos finales relacionados, eliminando por completo la superficie de ataque alcanzable por red."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "strapi",
          "product": "strapi",
          "versions": [
            {
              "version": ">= 5.0.0, < 5.33.2",
              "status": "affected"
            },
            {
              "version": ">= 4.0.0, < 4.26.1",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "strapi",
          "product": "@strapi/content-type-builder",
          "versions": [
            {
              "version": ">= 5.0.0, < 5.33.2",
              "status": "affected"
            },
            {
              "version": ">= 4.0.0, < 4.26.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T19:45:08.219015Z",
          "id": "CVE-2026-22599",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.26.1",
              "matchCriteriaId": "7D0EA7AE-CBE1-4382-935D-DD7AE91C5C8B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "5.0.0",
              "versionEndExcluding": "5.33.2",
              "matchCriteriaId": "2FB05E59-6F7E-4607-8ECD-6E529C30F1DA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/strapi/strapi/releases/tag/v4.26.1",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Product"
      ]
    },
    {
      "url": "https://github.com/strapi/strapi/releases/tag/v5.33.2",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Product"
      ]
    },
    {
      "url": "https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}