Exploit for SQL Injection in Strapi

abraxaslabs.tech · github.com/abraxas ·&...

SQL Injection

Strapi is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the column.defaultTo attribute in the Content-Type Builder write API, which allows an attacker to inject arbitrary database statements and potentially achieve file read, denial of service, or remote code...

CVE-2026-22599

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary...

CVE-2026-22599: Improper Neutralization of Special Elements used in an SQL Command

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary...