{"id":"CVE-2026-22599","sourceIdentifier":"security-advisories@github.com","published":"2026-05-14T19:16:29.650","lastModified":"2026-10-26T14:10:00.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely."},{"lang":"es","value":"Strapi es un sistema de gestión de contenido headless de código abierto. En versiones de la rama 4.x anteriores a la 4.26.1 y de la rama 5.x anteriores a la 5.33.2, existía una vulnerabilidad de inyección de consultas de base de datos en la API de escritura del Content-Type Builder de Strapi. Un administrador autenticado podía inyectar sentencias de base de datos arbitrarias a través del atributo ’column.defaultTo’ al crear o modificar un tipo de contenido. Establecer ’defaultTo’ como una tupla ’[value, { isRaw: true }]’ hacía que el valor se pasara directamente a ’db.connection.raw()’ de Knex durante la migración del esquema sin sanitización, permitiendo la ejecución de sentencias arbitrarias en la capa de base de datos. Dependiendo del motor de base de datos, esto permitía la lectura arbitraria de archivos a través de funciones de utilidad de base de datos, la denegación de servicio a través de un fallo forzado del servidor por error de migración de esquema, y en motores que permiten la ejecución de programas externos, la ejecución remota de código contra el servidor de base de datos. El parche en las versiones 4.26.1 y 5.33.2 aborda esto restringiendo todas las APIs de escritura del Content-Type Builder solo al modo de desarrollo. Las implementaciones de producción que ejecutan la v5.33.2 o posterior devuelven 404 para las solicitudes contra ’/content-type-builder/content-types’ y los puntos finales relacionados, eliminando por completo la superficie de ataque alcanzable por red."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"strapi","product":"strapi","versions":[{"version":">= 5.0.0, < 5.33.2","status":"affected"},{"version":">= 4.0.0, < 4.26.1","status":"affected"}]},{"vendor":"strapi","product":"@strapi/content-type-builder","versions":[{"version":">= 5.0.0, < 5.33.2","status":"affected"},{"version":">= 4.0.0, < 4.26.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-14T19:45:08.219015Z","id":"CVE-2026-22599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.26.1","matchCriteriaId":"7D0EA7AE-CBE1-4382-935D-DD7AE91C5C8B"},{"vulnerable":true,"criteria":"cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.33.2","matchCriteriaId":"2FB05E59-6F7E-4607-8ECD-6E529C30F1DA"}]}]}],"references":[{"url":"https://github.com/strapi/strapi/releases/tag/v4.26.1","source":"security-advisories@github.com","tags":["Patch","Product"]},{"url":"https://github.com/strapi/strapi/releases/tag/v5.33.2","source":"security-advisories@github.com","tags":["Patch","Product"]},{"url":"https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}