Executive brief
Strapi is an open-source content management system used to manage and deliver digital content. A security flaw in its file upload component allowed users with basic upload permissions to bypass security restrictions and upload prohibited file types, such as HTML or SVG files containing malicious scripts. If an administrator opens one of these files, an attacker could hijack their session and take full control of the management console.
Technical details
In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints (`uploadFiles` and `replaceFile`) failed to enforce administrator-configured MIME type restrictions defined in `plugin.upload.security.allowedTypes` and `deniedTypes`. While these checks were present in the Admin Panel upload path via the `enforceUploadSecurity` function, they were missing from the Content API controller, which called the underlying upload service directly. This bypass allows an authenticated attacker with Content API upload permissions to upload dangerous file types like HTML or SVG. In default deployments where uploaded files are served from the same origin as the admin panel, this can be leveraged for a Cross-Site Scripting (XSS) attack to hijack administrator sessions. The vulnerability is addressed in version 5.33.3 by implementing a shared `prepareUploadRequest` helper across all upload entry points.
Affected products
- Strapi @strapi/upload <= 5.33.2
Timeline
- 2026-01-09: other: Initial report by kaminuma
- 2026-05-13: advisory: GitHub advisory published
- 2026-05-14: disclosed: NVD publication date