Strapi Upload Plugin MIME Type Validation Bypass Vulnerability

A vulnerability exists in the Strapi Upload plugin's Content API endpoints in versions prior to 5.33.3. The issue arises because these endpoints did not properly enforce administrator-defined MIME type restrictions, allowing authenticated users with upload permissions to bypass security measures and upload disallowed file types, such as HTML and SVG. This flaw could lead to serious consequences, including the execution of malicious JavaScript in the admin panel, potentially hijacking admin sessions and facilitating unauthorized actions via the admin API.

Impact

Exploitation of this vulnerability could allow for unauthorized file uploads that bypass MIME type restrictions, leading to the execution of malicious scripts in the context of an admin user.

Remediation

Users are advised to update Strapi to version 5.33.3 or later.