受影响的版本系列
- 5.57 1 个 CVE
- 5.48 2 个 CVE
- 5.47 2 个 CVE
- 5.45 1 个 CVE
- 5.37 2 个 CVE
- 5.33 6 个 CVE
- 5.24 7 个 CVE
- 5.20 7 个 CVE
- 5.10 9 个 CVE
- 5.7 9 个 CVE
- 5.5 11 个 CVE
- 5.0 11 个 CVE
- 4.26 10 个 CVE
- 4.25 11 个 CVE
- 4.24 13 个 CVE
- 4.22 12 个 CVE
- 4.19 14 个 CVE
- 4.13 15 个 CVE
- 4.12 17 个 CVE
- 4.11 18 个 CVE
- 4.10 20 个 CVE
- 4.8 20 个 CVE
- 4.6 21 个 CVE KEV 1
- 4.5 23 个 CVE KEV 1
- 4.1 28 个 CVE KEV 1
- 4.0 29 个 CVE KEV 1
- 3.6 27 个 CVE KEV 1
- 3.2 30 个 CVE KEV 1
- 3.0 33 个 CVE
- 1.6 29 个 CVE
已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2023-22894 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by e... | * ≥ 3.2.1 < 4.8.0 | 4.9 | KEV | 4.1% | 2023-04-19 |
| CVE-2026-118171 | CVE-2026-118171 | * | 6.5 | — | 2026-10-28 | |
| CVE-2026-118172 | CVE-2026-118172 | * | 6.1 | — | 2026-10-28 | |
| CVE-2026-118170 | CVE-2026-118170 | * | 9.1 | — | 2026-10-28 | |
| CVE-2026-108114 | Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions | ≥ 5.47.0 ≤ 5.57.0 | 5.3 | — | 2026-10-10 | |
| CVE-2026-90561 | Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG | ≥ 4.0.0 ≤ 4.26.2 ≥ 5.0.0 < 5.48.1 | 9.3 | — | 2026-09-13 | |
| CVE-2026-57997 | Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration | < 5.7.0 | 6.3 | — | 2026-06-29 | |
| CVE-2026-27886 | Strapi may leak sensitive data via relational filtering due to lack of query sanitization | * ≥ 4.0.0 < 5.37.0 | 9.2 | — | 2026-05-14 | |
| CVE-2026-22707 | Strapi Upload Plugin MIME Validation Bypass via Content API | * < 5.33.3 | 5.3 | — | 2026-05-14 | |
| CVE-2026-22706 | Strapi: Password Reset Does Not Revoke Existing Refresh Sessions | * < 5.33.3 | 2.1 | — | 2026-05-14 | |
| CVE-2026-22599 | Strapi Vulnerable to SQL Injection in Content Type Builder | * ≥ 4.0.0 < 4.26.1 ≥ 5.0.0 < 5.33.2 | 9.3 | — | 2026-05-14 | |
| CVE-2025-64526 | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying | * < 5.45.0 | 6.9 | — | 2026-05-14 | |
| CVE-2025-3930 | Lack of JWT Expiration after Log Out in Strapi | < 5.24.1 | 6.3 | — | 2025-10-16 | |
| CVE-2025-53092 | Strapi core vulnerable to sensitive data exposure via CORS misconfiguration | * < 5.20.0 | 6.5 | — | 2025-10-16 | |
| CVE-2025-25298 | Missing Maximum Password Length Validation in Strapi Password Hashing | * < 5.10.3 | 6.3 | — | 2025-10-16 | |
| CVE-2024-56143 | Strapi Allows Unauthorized Access to Private Fields via parms.lookup | * ≥ 5.0.0 < 5.5.2 | 8.2 | — | 2025-10-16 | |
| CVE-2024-52588 | Strapi allows Server-Side Request Forgery in Webhook function | * < 4.25.2 | 7.5 | — | 2025-05-29 | |
| CVE-2024-37818 | Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_ne... | = 4.24.4 | 8.6 | — | 2024-06-20 | |
| CVE-2024-34065 | @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass | * < 4.24.2 | 8.1 | — | 2024-06-12 | |
| CVE-2024-31217 | @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling | * < 4.22.0 | 6.5 | — | 2024-06-12 | |
| CVE-2024-29181 | @strapi/plugin-content-manager leaks data via relations via the Admin Panel | * < 4.19.1 | 3.5 | — | 2024-06-12 | |
| CVE-2023-39345 | Unauthorized Access to Private Fields in User Registration API in strapi | * ≥ 4.0.0 < 4.13.1 | 7.5 | — | 2023-11-06 | |
| CVE-2023-38507 | Strapi Improper Rate Limiting vulnerability | * < 4.12.1 | 9.8 | — | 2023-09-15 | |
| CVE-2023-37263 | Strapi's field level permissions not being respected in relationship title | * < 4.12.1 | 2.7 | — | 2023-09-15 | |
| CVE-2023-36472 | Strapi may leak sensitive user information, user reset password, tokens via content-manager views | * < 4.11.7 | 5.7 | — | 2023-09-15 | |
| CVE-2023-34235 | Leaking sensitive user information still possible by filtering on private with prefix fields | * < 4.10.8 | 7.5 | — | 2023-07-25 | |
| CVE-2023-34093 | Strapi allows actors to make all attributes on a content-type public without noticing it | * < 4.10.8 | 7.1 | — | 2023-07-25 | |
| CVE-2023-22621 | Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execu... | * ≥ 3.0.0 < 4.5.6 | 7.2 | — | 2023-04-19 | |
| CVE-2023-22893 | Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito... | * ≥ 3.0.0 < 4.6.0 | 7.5 | — | 2023-04-19 | |
| CVE-2022-31367 | Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. | * < 3.6.10 ≥ 4.0.0 < 4.1.10 | 8.8 | — | 2022-09-27 | |
| CVE-2022-32114 | An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to... | * = 4.1.12 | 8.8 | — | 2022-07-13 | |
| CVE-2022-29894 | Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function... | = v3.x.x versions and earlier ≤ 3.6.10 | 4.8 | — | 2022-06-13 | |
| CVE-2022-30617 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email... | * ≥ 3.0.0 < 3.6.9 ≥ 3.0.0 < 3.6.10 | 8.8 | — | 2022-05-19 | |
| CVE-2022-30618 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email... | * ≥ 3.0.0 < 3.6.9 ≥ 3.0.0 < 3.6.10 | 7.5 | — | 2022-05-19 | |
| CVE-2022-29622 | An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a c... | * | — | — | 2022-05-16 | |
| CVE-2021-46440 | Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x... | * < 3.6.9 ≥ 4.0.0 < 4.1.5 | 7.5 | — | 2022-05-03 | |
| CVE-2022-27263 | An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute... | * ≤ 4.1.5 = 4.1.5 | 9.8 | — | 2022-04-12 | |
| CVE-2022-0764 | Arbitrary Command Injection in strapi/strapi | * < 4.1.0 | 6.7 | — | 2022-02-26 | |
| CVE-2021-28128 | In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the curren... | * ≤ 3.6.0 | 8.1 | — | 2021-05-06 | |
| CVE-2020-27665 | In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) route... | * < 3.2.5 | 7.5 | — | 2020-10-22 | |
| CVE-2020-27666 | Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature. | * < 3.2.5 | 5.4 | — | 2020-10-22 | |
| CVE-2020-27664 | admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functi... | * < 3.2.5 | 9.8 | — | 2020-10-22 | |
| CVE-2020-13961 | Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templa... | * < 3.0.2 | 6.5 | — | 2020-06-19 | |
| CVE-2020-8123 | A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console usin... | < 3.0.0 = 3.0.0 | 4.9 | — | 2020-02-04 | |
| CVE-2019-19609 | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstal... | * < 3.0.0-beta.17.8 ≤ 1.6.4 | 7.2 | — | 2019-12-05 | |
| CVE-2019-18818 | strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and... | * < 3.0.0-beta.17.5 ≤ 1.6.4 | 9.8 | — | 2019-11-07 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。