Is CVE-2026-22707 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22707 being exploited in the wild.

How severe is CVE-2026-22707?

Medium severity, with a CVSS score of 5.4, published 14 May 2026.

Which products and versions are affected?

@strapi/upload (npm) <= 5.33.2, SEMVER:introduced=0,fixed=5.33.3; Strapi Upload < 5.33.3, <= 5.33.2.

Is there a fix for CVE-2026-22707?

Yes. @strapi/upload (npm): upgrade to 5.33.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22707 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-22707?

Check whether you run @strapi/upload (npm) or Strapi Upload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22707: Strapi Upload plugin MIME validation bypass in Content API

Q: Is there a fix for CVE-2026-22707?

Yes. @strapi/upload (npm): upgrade to 5.33.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-22707 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-22707?

Check whether you run @strapi/upload (npm) or Strapi Upload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22707 · Severity: medium · CVSS 5.4 · Published 2026-05-14

Strapi is an open-source content management system used to manage and deliver digital content. A security flaw in its file upload component allowed users with basic upload permissions to bypass security restrictions and upload prohibited file types, such as HTML or SVG files containing malicious scripts. If an administrator opens one of these files, an attacker could hijack their session and take full control of the management console.

Vendors: npm, Strapi.

Quick answers

Is CVE-2026-22707 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22707 being exploited in the wild.
How severe is CVE-2026-22707?: Medium severity, with a CVSS score of 5.4, published 14 May 2026.
Which products and versions are affected?: @strapi/upload (npm) <= 5.33.2, SEMVER:introduced=0,fixed=5.33.3; Strapi Upload < 5.33.3, <= 5.33.2.
Is there a fix for CVE-2026-22707?: Yes. @strapi/upload (npm): upgrade to 5.33.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22707 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-22707?: Check whether you run @strapi/upload (npm) or Strapi Upload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@strapi/upload (npm): upgrade to 5.33.3 or later
```
npm install @strapi/upload@5.33.3
```

Technical details

In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints (`uploadFiles` and `replaceFile`) failed to enforce administrator-configured MIME type restrictions defined in `plugin.upload.security.allowedTypes` and `deniedTypes`. While these checks were present in the Admin Panel upload path via the `enforceUploadSecurity` function, they were missing from the Content API controller, which called the underlying upload service directly. This bypass allows an authenticated attacker with Content API upload permissions to upload dangerous file types like HTML or SVG. In default deployments where uploaded files are served from the same origin as the admin panel, this can be leveraged for a Cross-Site Scripting (XSS) attack to hijack administrator sessions. The vulnerability is addressed in version 5.33.3 by implementing a shared `prepareUploadRequest` helper across all upload entry points.

Affected products

Strapi @strapi/upload <= 5.33.2

Identifiers

CVE-2026-22707
GHSA-pcw7-5633-82vv

Timeline

2026-01-09: other: Initial report by kaminuma
2026-05-13: advisory: GitHub advisory published
2026-05-14: disclosed: NVD publication date

References

https://github.com/strapi/strapi/security/advisories/GHSA-pcw7-5633-82vv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.