Summary
generated automatically from NVD dataStrapi, in versions through 4.5.5, contains a Server-Side Template Injection flaw (CWE-74) affecting email templates. An authenticated remote attacker with access to the admin panel can submit a crafted payload that evades the validation checks meant to block code execution, causing arbitrary code to run on the server. The vulnerability has a CVSS v3.1 score of 7.2 (HIGH), with high impact on confidentiality, integrity and availability.
NVD description
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.
EPSS · FIRST.org
70.6%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 19 avr. 2023
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (6)
- https://github.com/strapi/strapi/releasesRelease Notes
- https://www.ghostccamm.com/blog/multi_strapi_vulns/ExploitThird Party Advisory
- https://github.com/strapi/strapi/releasesRelease Notes
- https://www.ghostccamm.com/blog/multi_strapi_vulns/ExploitThird Party Advisory
Similar CVEs
Other vulnerabilities of type CWE-74
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.