CVE-2023-22621: Strapi admin email template SSTI allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw yields remote code execution with high EPSS and a public exploit reference, but requires an authenticated high-privileged admin account, which limits the attack population.

What it is

Strapi through 4.5.5 is vulnerable to authenticated server-side template injection in email templates. A payload injected through the admin panel bypasses validation checks meant to block code execution, allowing arbitrary code to run on the server. Because the affected component is the admin email template editor, the flaw turns a trusted administrative feature into a code execution path.

Impact

An attacker with admin panel access gains arbitrary code execution on the Strapi server, which can lead to full compromise of the host, its data and any connected services. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network through the Strapi admin panel, so the attacker must already hold a high-privileged authenticated account; no user interaction is required per the CVSS vector. The injection point is the email template content that is rendered server-side.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.768 (99.5th percentile) and a public third-party advisory is tagged as an exploit reference, indicating exploit code or detailed exploitation guidance is publicly available.

What to do

• Upgrade Strapi to a release after 4.5.5 that fixes the email template validation bypass; check the vendor release notes for the exact fixed version.
• Restrict and audit admin panel accounts, enforcing least privilege and removing unused or stale admin users.
• Place the Strapi admin panel behind network controls such as VPN or IP allowlisting so it is not exposed to the internet.
• Review and sanitize email template content, and treat template editing as a privileged code-execution-capable action.
• Monitor Strapi server processes for unexpected child processes or outbound connections originating from the application.

Detection

• Audit Strapi admin activity logs for email template creation or modification events, especially by unusual accounts or at odd hours.
• Inspect email template content for template syntax or code-like payloads that should not appear in legitimate templates.
• Monitor the Strapi host for unexpected process spawning, reverse shells or outbound connections from the Node.js process.
• Alert on new or changed admin accounts and on admin logins from unfamiliar source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.