Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@strapi/upload

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3npmAmendedPublished

    Strapi Upload Plugin MIME Validation Bypass via Content API

    CVE-2026-22707 · GHSA-pcw7-5633-82vv

    Affected
    • npm @strapi/upload <= 5.33.2
    Fixed in
    5.33.3· Vendor fix available
    Issue
    of CVE-2026-22707 Vulnerability Details - CVE: CVE-2026-22707 - CVSS v3.1 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (5.3 — Medium) - Affected Versions: @strapi/upload <=5.33.2 - How to Patch: Immediately update your Strapi to =5.33.3 Description of CVE-2026-22707 In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions (plugin.upload.security.allowedTypes and deniedTypes). The same restrictions were correctly enforced on the Admin Panel upload path. The upload plugin's enforceUploadSecurity security check was invoked in the admin upload controller but was missing from the Content API controller. The Content API handlers uploadFiles and replaceFile (and the upload wrapper that dispatches to them) called the underlying upload service directly, bypassing both the magic-byte MIME detection and the configured allow/deny lists. An authenticated user with the…

    Recommended action: Upgrade to 5.33.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →