Is CVE-2022-32114 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-32114 being exploited in the wild.

How severe is CVE-2022-32114?

Low severity, with a CVSS score of 3.1, published 14 July 2022.

Which products and versions are affected?

@strapi/strapi (npm) SEMVER:introduced=0,last_affected=4.1.12.

Is there a fix for CVE-2022-32114?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2022-32114 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-32114?

Check whether you run @strapi/strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-32114: Strapi cross-site scripting via malicious file upload

CVE-2022-32114 · Severity: low · CVSS 3.1 · Published 2022-07-14

Strapi is a popular headless CMS (content management system) used to manage digital content for websites and applications. In version 4.1.12, the Media Library feature allows authenticated users to upload files without proper validation. An attacker can upload a file containing malicious code, and when another user opens the file's link, the attacker's script runs in their browser—potentially stealing login credentials, session tokens, or redirecting them to malicious sites.

Technologies: @strapi/strapi (npm). Vendors: npm.

Quick answers

Is CVE-2022-32114 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-32114 being exploited in the wild.
How severe is CVE-2022-32114?: Low severity, with a CVSS score of 3.1, published 14 July 2022.
Which products and versions are affected?: @strapi/strapi (npm) SEMVER:introduced=0,last_affected=4.1.12.
Is there a fix for CVE-2022-32114?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-32114 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-32114?: Check whether you run @strapi/strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in Strapi's Media Library upload functionality. The vulnerability arises from insufficient input validation and output encoding on uploaded files. An authenticated attacker with Media Library upload permissions can craft and upload a file containing malicious JavaScript or HTML (e.g., a PDF or other document with embedded XSS payload). When a victim clicks "copy link" and opens the file URL in a browser, the payload executes in their security context. The attack requires prior authentication and victim interaction (opening the link), but no special privileges beyond basic file-upload permissions. The vulnerability affects Strapi v4.1.12 and likely earlier versions. Patches and configuration hardening via file-type restrictions and Content-Security-Policy headers are recommended.

Affected products

Strapi @strapi/strapi 4.1.12 and likely earlier versions

Identifiers

CVE-2022-32114
GHSA-4vm8-j95f-j6v5

Timeline

2022-05-29: disclosed: Vulnerability publicly disclosed
2022-07-14: advisory: CVE-2022-32114 reserved; GHSA-4vm8-j95f-j6v5 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.