Executive brief
Strapi is a popular open-source headless CMS used to manage and deliver content via APIs. The Content Type Builder, an admin interface component, contained a SQL injection vulnerability that allowed authenticated administrators to inject arbitrary database commands. An attacker with admin credentials could read sensitive files from the database server, cause service outages, or potentially execute arbitrary code on the database host depending on the database engine capabilities.
Technical details
A database-query injection vulnerability existed in the Strapi Content-Type Builder write API (CWE-89: SQL injection). An authenticated administrator could inject arbitrary database statements through the column.defaultTo attribute when creating or modifying a content type. When the defaultTo attribute was set as a tuple [value, { isRaw: true }], the value was passed directly to Knex's db.connection.raw() without sanitization during schema migration, allowing arbitrary SQL execution at the database layer. This required high privileges (admin authentication) and network access to the /content-type-builder/content-types API endpoints. Depending on the database engine, exploitation could enable arbitrary file read via database utility functions, denial of service via forced server crash, or remote code execution on the database server. The patch restricts Content-Type Builder write APIs to development mode only; in production, v5.33.2+ returns 404 for these endpoints, removing the attack surface entirely.
Affected products
- Strapi @strapi/content-type-builder 5.0.0 to 5.33.1
- Strapi @strapi/plugin-content-type-builder 4.0.0 to 4.26.0
Timeline
- 2026-05-13: disclosed: Vulnerability advisory published
- 2026-01-08: patched: Patches released: v5.33.2 and v4.26.1