HIGH8.6
GHSA-p9ff-j98v-p435
Strapi Server-Side Request Forgery (SSRF)
Details
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/@strapi/strapi
No fixed version published yet for @strapi/strapi (npm). Pin to a known-safe version or switch to an alternative.