Strapi: Mehrere Schwachstellen
WID-SEC-2023-1040 · first 20.04.2023 · updated 13.10.2026 · CVSS 10,0
What it is about
Strapi ist ein headless Content-Management-System (CMS), dass als Open-Source-Software entwickelt wird. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Strapi ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode auszuführen
- Sicherheitsvorkehrungen zu umgehen
- Informationen offenzulegen
Am I affected?
Affected according to the BSI:
- Open Source Strapi <4.5.6
- Open Source Strapi <4.6.0
- Open Source Strapi <4.8.0
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Strapi 4.5.6
- Open Source Strapi 4.6.0
- Open Source Strapi 4.8.0
Is the vulnerability already being exploited?
- CVE-2023-22894: exploited in the wild according to CISA, in the catalogue since 08.10.2026.
- According to a CISA advisory, used by actors from China: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (10/2026)
Information and sources
- Original BSI advisory (WID)
- strapi Security Disclosure of Vulnerabilities vom 2023-04-19 strapi.io
- Exploit CVE-2023-22894 www.cisa.gov
CVE: CVE-2023-22621, CVE-2023-22893, CVE-2023-22894
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.