Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

GHSA-rjg2-95x7-8qmx — @strapi/strapi

GHSA-rjg2-95x7-8qmx is a Path Traversal vulnerability in @strapi/strapi. A fix is available for @strapi/strapi — see the affected versions and patch details below.

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

Also known asCVE-2026-27886
Published
May 14, 2026
Updated
May 16, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Sep 26, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
2.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs84th percentile — riskier than 84% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

110other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@strapi/strapinpm
230Kdownloads / week

Description

Summary of CVE-2026-27886 Vulnerability Details

  • CVE: CVE-2026-27886
  • CVSS v3.1 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N (9.3 — Critical)
  • Affected Versions: @strapi/strapi <=5.36.1
  • How to Patch: Immediately update your Strapi to >=5.37.0

Description of CVE-2026-27886

Strapi versions prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the where query parameter on any publicly-accessible content-type with an updatedBy (or other admin-relation) field to perform a boolean-oracle attack against private fields on the joined admin_users table, including the resetPasswordToken field. Extracting an admin reset token via this oracle made full administrative account takeover possible without authentication.

When a filter such as where[updatedBy][resetPasswordToken][$startsWith]=a was applied to a public Content API endpoint, the underlying query generation performed a LEFT JOIN against the admin_users table and emitted a WHERE clause referencing the joined column. The query parameter sanitization layer did not block operator chains that traversed into relational target schemas the caller had no read permission on, allowing the response count to be used as a one-bit oracle on any admin-table field.

The patch introduces explicit query-parameter sanitization at the controller and service boundary via three new primitives: strictParam, addQueryParams, and addBodyParams. Operator chains that traverse into restricted relational targets are now rejected before reaching the database.

IoC's for CVE-2026-27886

Indicators that an instance running an unpatched version may have been exploited:

  • Server access logs containing query strings traversing into admin-relation private fields. Regex: \?(.*&)?where\[(updatedBy|createdBy|publishedBy)\]\[(email|password|resetPasswordToken|confirmationToken|firstname|lastname|preferedLanguage)\]\[\$(startsWith|contains|eq|gt|lt|ge|le|in|notIn|notNull|null)\]=
  • High volume of public Content API requests from a single IP iterating through a hex alphabet (0-9, a-f) on the same content-type endpoint with progressively-longer filter values
  • Subsequent POST /admin/reset-password calls using a reset token that the legitimate admin did not request
  • Successful admin password change immediately following a burst of public Content API requests with where[updatedBy] query parameters
  • Sustained burst of identical-shape requests with only the trailing character of the filter value varying

Credit

Discovered by: James Doll - WildWest CyberSecurity Contact: [email protected] Website: https://wildwestcyber.com LinkedIn: https://www.linkedin.com/in/james-doll-273a61243

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npm@strapi/strapi≥ 4.0.0&&< 5.37.05.37.0npm install @strapi/strapi@5.37.0

Affected Products

1 product · 1 configurations
Application
strapistrapi
≥ 4.0.0 && < 5.37.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @strapi/strapi, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @strapi/strapi to 5.37.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-rjg2-95x7-8qmx is resolved across your whole dependency graph.

  3. Workarounds

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

### Summary of CVE-2026-27886 Vulnerability Details - CVE: CVE-2026-27886 - CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N` (9.3 — Critical) - Affected Versions: `@strapi/strapi` <=5.36.1 - How to Patch: Immediately update your Strapi to >=5.37.0 ### Description of CVE-2026-27886 Strapi versions prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter on any publicly-accessible content-type with an `updatedBy` (or other admin-relation) fie
O3 Security · Impact-Aware SCA

Is GHSA-rjg2-95x7-8qmx in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-rjg2-95x7-8qmx: @strapi/strapi | O3 Security