Attack Chain

1. An attacker authenticates as an administrator in Strapi.
2. The attacker crafts a malicious HTTP POST or PUT request to /content-type-builder/content-types or related endpoints.
3. The request includes a payload designed to create or modify a content type.
4. Within the payload, the column.defaultTo attribute is set with a tuple [value, { isRaw: true }]. The value contains a SQL injection payload.
5. Strapi’s Content-Type Builder processes the request and passes the value directly into Knex’s db.connection.raw() function.
6. The database executes the injected SQL statement, performing actions such as arbitrary file read, causing a denial-of-service by crashing the server, or potentially executing arbitrary code on the database server, depending on the database engine’s capabilities.
7. The attacker exfiltrates sensitive data read from the file system.
8. The attacker gains unauthorized access to the Strapi application or the database server.

Impact

Successful exploitation of CVE-2026-22599 can lead to severe consequences, including unauthorized access to sensitive data, denial of service, and potentially remote code execution on the database server. Observed damage includes unexpected files appearing on the database host, Strapi server crashes following content-type creation or updates, and unusual DEFAULT clause values in database server logs. The vulnerability affects any Strapi instance running vulnerable versions of the @strapi/content-type-builder or @strapi/plugin-content-type-builder packages.

Recommendation

• Immediately update Strapi to versions >=5.33.2 (v5) or >=4.26.1 (v4) to apply the patch that restricts Content-Type Builder write APIs to development mode, mitigating the vulnerability described in CVE-2026-22599.
• Monitor HTTP access logs for POST or PUT requests to /content-type-builder/content-types endpoints from non-internal sources using the regex pattern (POST|PUT)\s+/content-type-builder/ to identify potential exploitation attempts.
• Analyze database server logs for unexpected DEFAULT clause values that reference filesystem-access or program-execution helper functions to detect successful SQL injection.
• Deploy the provided Sigma rule to detect potential exploitation attempts based on HTTP requests to the Content-Type Builder endpoints.