# CVE-2022-32114: Strapi cross-site scripting via malicious file upload

Source: https://junglewise.ai/threats/cve-2022-32114-strapi-cross-site-scripting-via-malicious-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-32114 · Severity: low · CVSS 3.1 · Published 2022-07-14

Strapi is a popular headless CMS (content management system) used to manage digital content for websites and applications. In version 4.1.12, the Media Library feature allows authenticated users to upload files without proper validation. An attacker can upload a file containing malicious code, and when another user opens the file's link, the attacker's script runs in their browser—potentially stealing login credentials, session tokens, or redirecting them to malicious sites.

Technologies: [@strapi/strapi (npm)](https://junglewise.ai/threats/technologies/strapi-strapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-32114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-32114 being exploited in the wild.

**How severe is CVE-2022-32114?** Low severity, with a CVSS score of 3.1, published 14 July 2022.

**Which products and versions are affected?** @strapi/strapi (npm) SEMVER:introduced=0,last_affected=4.1.12.

**Is there a fix for CVE-2022-32114?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-32114 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-32114?** Check whether you run @strapi/strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in Strapi's Media Library upload functionality. The vulnerability arises from insufficient input validation and output encoding on uploaded files. An authenticated attacker with Media Library upload permissions can craft and upload a file containing malicious JavaScript or HTML (e.g., a PDF or other document with embedded XSS payload). When a victim clicks "copy link" and opens the file URL in a browser, the payload executes in their security context. The attack requires prior authentication and victim interaction (opening the link), but no special privileges beyond basic file-upload permissions. The vulnerability affects Strapi v4.1.12 and likely earlier versions. Patches and configuration hardening via file-type restrictions and Content-Security-Policy headers are recommended.

## Affected products

- Strapi @strapi/strapi 4.1.12 and likely earlier versions

## Identifiers

- CVE-2022-32114
- GHSA-4vm8-j95f-j6v5

## Timeline

- 2022-05-29: disclosed: Vulnerability publicly disclosed
- 2022-07-14: advisory: CVE-2022-32114 reserved; GHSA-4vm8-j95f-j6v5 published

## References

- [https://docs.strapi.io/dev-docs/configurations/public-assets](https://docs.strapi.io/dev-docs/configurations/public-assets)
- [https://docs.strapi.io/user-docs/users-roles-permissions/configuring-administrator-roles](https://docs.strapi.io/user-docs/users-roles-permissions/configuring-administrator-roles)
- [https://github.com/bypazs/strapi](https://github.com/bypazs/strapi)
- [https://github.com/strapi/strapi](https://github.com/strapi/strapi)
- [https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/content-type-builder/admin/src/components/AllowedTypesSelect/index.js](https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/content-type-builder/admin/src/components/AllowedTypesSelect/index.js)
- [https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/upload/admin/src/components/MediaLibraryInput/index.js](https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/upload/admin/src/components/MediaLibraryInput/index.js)

## Related threats

- [Strapi administrative account takeover via relational query filtering](https://junglewise.ai/threats/cve-2026-27886-strapi-administrative-account-takeover-via-relational-query)
- [Strapi insufficient session expiration in JWT authentication](https://junglewise.ai/threats/cve-2025-3930-strapi-insufficient-session-expiration-in-jwt-authentication)
- [Strapi Server-Side Request Forgery](https://junglewise.ai/threats/cve-2024-37818-strapi-server-side-request-forgery)
- [Strapi authorization bypass in user registration API](https://junglewise.ai/threats/cve-2023-39345-strapi-authorization-bypass-in-user-registration-api)
- [Strapi content-type attribute disclosure via extension](https://junglewise.ai/threats/cve-2023-34093-strapi-content-type-attribute-disclosure-via-extension)