Skip to content
OpenAdvisories

Product · strapi

@strapi/upload

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-22707

    Strapi Upload Plugin MIME Validation Bypass via Content API

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions (`plugin.upload.security.allowedTypes` and `deniedTy…

    strapi strapi @strapi/upload @strapi/upload npm