CVE-2022-32114: 
JavaScript vulnerability analysis and mitigation

An unrestricted file upload vulnerability was discovered in Strapi version 4.1.12, specifically in the Add New Assets function of the Media Library. This vulnerability, identified as CVE-2022-32114, was discovered on May 29, 2022, and allows attackers to conduct XSS attacks via crafted files (GrimTheRipper Blog).

The vulnerability exists in the Media Library's file upload functionality where the system fails to properly validate uploaded files. This allows attackers to upload files containing malicious content that can execute when accessed. The vulnerability specifically affects the Add New Assets function, where the file upload restrictions can be bypassed (NVD).

When successfully exploited, this vulnerability allows attackers to execute arbitrary code through XSS attacks. When users access the uploaded malicious file through its link, the embedded malicious content executes in the user's browser context (GrimTheRipper Blog).

Users should upgrade to a patched version of Strapi beyond version 4.1.12. Additionally, it's recommended to implement proper file upload validation and restrict file types that can be uploaded through the Media Library (NVD).