EUVD-2026-111347

The strapi/strapi Core Admin / Webhook Runner package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target...

CVE-2026-118172 CVE-2026-118172

The strapi/strapi Core Admin / Webhook Runner package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target...

PT-2026-127201

The strapi/strapi Core Admin / Webhook Runner package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target...

@avorati/strapi-plugin-preview (1.0.1), @beardeddudes/strapi-types (>=0.1.0, <=0.1.1) +138 more potentially affected by CVE-2026-27886 via @strapi/strapi (>=4.0.2, <=5.36.0)

@strapi/strapi NPM version =4.0.2, =0.1.0, =1.0.1, =4.12.2, =1.0.0, =1.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =1.3.3 and more Source cves: CVE-2026-27886 Source advisory: MEND:CVE-2026-27886...

@avorati/strapi-plugin-preview (1.0.1), @beardeddudes/strapi-types (>=0.1.0, <=0.1.1) +138 more potentially affected by CVE-2026-27886 via @strapi/strapi (>=4.0.2, <=5.36.0)

@strapi/strapi NPM version =4.0.2, =0.1.0, =1.0.1, =4.12.2, =1.0.0, =1.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =1.3.3 and more Source cves: CVE-2026-27886 Source advisory: OSV:GHSA-RJG2-95X7-8QMX...

@avorati/strapi-plugin-preview (1.0.1), @beardeddudes/strapi-types (>=0.1.0, <=0.1.1) +138 more potentially affected by CVE-2026-27886 via @strapi/strapi (>=4.0.2, <=5.36.0)

@strapi/strapi NPM version =4.0.2, =0.1.0, =1.0.1, =4.12.2, =1.0.0, =1.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =1.3.3 and more Source cves: CVE-2026-27886 Source advisory: SNYK:JS-STRAPISTRAPI-16690611...

@avorati/strapi-plugin-preview (1.0.1), @beardeddudes/strapi-types (>=0.1.0, <=0.1.1) +138 more potentially affected by CVE-2026-27886 via @strapi/strapi (>=4.0.2, <=5.36.0)

@strapi/strapi NPM version =4.0.2, =0.1.0, =1.0.1, =4.12.2, =1.0.0, =1.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =1.3.3 and more Source cves: CVE-2026-27886 Source advisory: GHSA-RJG2-95X7-8QMX...

@futurebrand/helpers-strapi (>=2.0.0, <=2.0.1), @jhoward1994/strapi-plugin-ckeditor (>=0.0.1-rc1, <=0.0.1) +5 more potentially affected by CVE-2025-25298 via @strapi/core (>=5.0.0-alpha.0, <=5.10.2)

@strapi/core NPM version =5.0.0-alpha.0, =2.0.0, =0.0.1-rc1, =2.0.0, =5.0.0-alpha.0, =3.0.0-beta.1, =3.0.0-beta.2 Source cves: CVE-2025-25298 Source advisory: GHSA-2CJV-6WG9-F4F3...

@avorati/strapi-plugin-preview (1.0.1), @futurebrand/helpers-strapi (>=2.0.0, <=2.5.4) +5 more potentially affected by CVE-2025-3930 via @strapi/strapi (>=5.0.0-rc.10, <=5.16.1)

@strapi/strapi NPM version =5.0.0-rc.10, =2.0.0, =2.0.0, =3.0.0-beta.1, =3.0.0-beta.2 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-3930 Source advisory: OSV:GHSA-4R8W-3JWW-M2RP...

@avorati/strapi-plugin-preview (1.0.1), @futurebrand/helpers-strapi (>=2.0.0, <=2.5.4) +5 more potentially affected by CVE-2025-3930 via @strapi/strapi (>=5.0.0-rc.10, <=5.16.1)

@strapi/strapi NPM version =5.0.0-rc.10, =2.0.0, =2.0.0, =3.0.0-beta.1, =3.0.0-beta.2 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2025-3930 Source advisory: GHSA-4R8W-3JWW-M2RP...

@avorati/strapi-plugin-preview (1.0.1), @beardeddudes/strapi-types (>=0.1.0, <=0.1.1) +136 more potentially affected by CVE-2025-3930 via @strapi/strapi (>=0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, <=5.16.1)

@strapi/strapi NPM version =0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, =0.1.0, =1.0.1, =4.12.2, =1.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =1.3.3 - @cowprotocol/cms 0.1.0-rc.5 and more Source cves: CVE-2025-3930 Source advisory: MEND:CVE-2025-3930...

@strapi/data-transfer (4.24.4), strapi-test-plugin (0.1.0) potentially affected by CVE-2024-37818 via @strapi/strapi (4.24.4)

@strapi/strapi NPM version 4.24.4 is affected by a known vulnerability. The following packages have a transitive dependency on @strapi/strapi and may be impacted: - @strapi/data-transfer 4.24.4 - strapi-test-plugin 0.1.0 Source cves: CVE-2024-37818 Source advisory: OSV:GHSA-P9FF-J98V-P435...

@strapi/data-transfer (4.24.4), strapi-test-plugin (0.1.0) potentially affected by CVE-2024-37818 via @strapi/strapi (4.24.4)

@strapi/strapi NPM version 4.24.4 is affected by a known vulnerability. The following packages have a transitive dependency on @strapi/strapi and may be impacted: - @strapi/data-transfer 4.24.4 - strapi-test-plugin 0.1.0 Source cves: CVE-2024-37818 Source advisory: GHSA-P9FF-J98V-P435...

@beardeddudes/strapi-types (0.1.0), @bimbeo160/admin (4.12.2) +58 more potentially affected by CVE-2023-39345 via @strapi/strapi (>=4.0.2, <=4.13.0)

@strapi/strapi NPM version =4.0.2, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.9.2, =4.9.2, =1.0.5, =1.0.5, =2.0.13 and more Source cves: CVE-2023-39345 Source advisory: MEND:CVE-2023-39345...

@beardeddudes/strapi-types (0.1.0), @bimbeo160/admin (4.12.2) +58 more potentially affected by CVE-2023-39345 via @strapi/strapi (>=4.0.2, <=4.13.0)

@strapi/strapi NPM version =4.0.2, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.9.2, =4.9.2, =1.0.5, =1.0.5, =2.0.13 and more Source cves: CVE-2023-39345 Source advisory: OSV:GHSA-GC7P-J5XM-XXH2...

@beardeddudes/strapi-types (0.1.0), @bimbeo160/admin (4.12.2) +58 more potentially affected by CVE-2023-39345 via @strapi/strapi (>=4.0.2, <=4.13.0)

@strapi/strapi NPM version =4.0.2, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.9.2, =4.9.2, =1.0.5, =1.0.5, =2.0.13 and more Source cves: CVE-2023-39345 Source advisory: GHSA-GC7P-J5XM-XXH2...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.5.1), @codeparticle/strapi (4.9.2) +33 more potentially affected by CVE-2023-34093 via @strapi/strapi (>=4.0.0-beta.0, <=4.10.8-exp.0)

@strapi/strapi NPM version =4.0.0-beta.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.9.2, =4.9.2, =1.0.5, =1.0.5, =1.0.0-alpha.0, =1.0.0-alpha.3 - @nexacarts/admin 2.0.9 - @nexacarts/cms 2.0.9 and more Source cves: CVE-2023-34093 Source advisory: GHSA-CHMR-RG2F-9JMF...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.5.1), @codeparticle/strapi (4.9.2) +33 more potentially affected by CVE-2023-34093 via @strapi/strapi (>=4.0.0-beta.0, <=4.10.8-exp.0)

@strapi/strapi NPM version =4.0.0-beta.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.9.2, =4.9.2, =1.0.5, =1.0.5, =1.0.0-alpha.0, =1.0.0-alpha.3 - @nexacarts/admin 2.0.9 - @nexacarts/cms 2.0.9 and more Source cves: CVE-2023-34093 Source advisory: OSV:GHSA-CHMR-RG2F-9JMF...

@code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.5.1), @codeparticle/strapi (4.9.2) +34 more potentially affected by CVE-2023-34093 via @strapi/strapi (>=0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, <=4.10.8-exp.0)

@strapi/strapi NPM version =0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.9.2, =4.9.2, =1.0.5, =1.0.5, =1.0.0-alpha.0, =1.0.0-alpha.3 - @nexacarts/admin 2.0.9 - @nexacarts/cms 2.0.9 and more Source cves: CVE-2023-34093 Source advisory: MEND:CVE-2023-34093...

Sensitive Information Disclosure

@strapi/strapi is vulnerable to Information Disclosure. An unauthenticated attacker can filter users by columns that contain sensitive information and infer the values by the changes in the API responses, which leads to hijacking Strapi administrator accounts and gaining unauthorized Strapi Super...