CVE-2026-22599

The vulnerability results from lack of sanitization of the `column.defaultTo` attribute value during content type creation or modification. Passing a value as a tuple `[value, { isRaw: true }]` caused the value to be passed directly to the `db.connection.raw()` function of the Knex library during schema migration, without any verification. In this way, an attacker could execute arbitrary SQL commands at the database engine level. On engines offering file reading features or running external programs, the attack scope extends respectively to server file disclosure and remote code execution (RCE).

An attacker with administrator privileges can execute arbitrary SQL commands, which in practice enables reading server files through built-in database functions, causing server failure (DoS) through schema migration error, and on some database engines — remote code execution (RCE) on the database server.

Strapi must be updated to version 4.26.1 (4.x branch) or 5.33.2 (5.x branch). The patch restricts access to all Content-Type Builder write APIs exclusively to developer mode; production environments running version 5.33.2 or newer return a 404 response to requests to `/content-type-builder/content-types` and related endpoints, eliminating the vulnerable attack surface.

Strapi in the 4.x branch in all versions before 4.26.1 and in the 5.x branch in all versions before 5.33.2