CVE-2023-22621
Published: April 21, 2026
Official Description
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.
Risk Analysis
This vulnerability in Strapi allows an authenticated attacker with admin panel access to execute arbitrary code on the server. The flaw involves injecting malicious code into email templates, bypassing existing validation. This is a critical issue as it can lead to full system compromise.
Active exploitation of this vulnerability has been observed in the wild, and it is listed in CISA's KEV catalog, indicating confirmed exploitation. The flaw is remotely exploitable given the attacker has access to the Strapi admin panel.
Upgrade Strapi to a version beyond 4.5.5 to address the server-side template injection vulnerability. Ensure that administrative interfaces are properly secured and access is restricted to trusted personnel.
Technical Analysis
CVE-2023-22621 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2023-22621 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2023-22621 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1