PT-2026-90832
CVE-2026-90561
·
تاريخ النشر
2026-09-13
·
تاريخ التحديث
2026-09-18
الوصف من
CVSS 4.0
9.3
حرجةالمقاييسAV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Name of the Vulnerable Software and Affected Versions
Strapi versions 4.x through 4.26.2
Strapi versions prior to 5.48.1
Description
A stored cross-site scripting issue exists in the content manager WYSIWYG preview component due to a failure to strip script tags from rich text. A user with the Author role can inject malicious script tags into rich text fields. These scripts execute within the session of an Editor or Super Admin when the preview pane is expanded, which can lead to account takeover.
Recommendations
Update Strapi versions 4.x through 4.26.2 to version 4.26.3.
Update Strapi versions prior to 5.48.1 to version 5.48.1.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾