CVSS 3.1
4.8 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NCVE-2022-29894
Medium (4.8) in strapi strapi. EPSS 0.8% chance of exploitation in the next 30 days.
Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- strapi:strapi
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mcqm-6ff4-53qx | npm | strapi | <=3.6.10 | no fix published |