CVE-2023-22621

Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CNA

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

70.60% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-74

Published

2023-04-19

Updated

2025-11-07

Proof-of-concept exploits (2)

• https://www.ghostccamm.com/blog/multi_strapi_vulns/
• sofianeelhor/CVE-2023-22621-POC23★ · 2023-04-25

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22621.yaml

Security advisories

• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
• https://www.ghostccamm.com/blog/multi_strapi_vulns
• advisories/GHSA-2h87-4q2w-v4hf
• strapi/strapi/releases

References

• CVE Record
• NVD entry