CVE-2026-105865
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed.
Risk Assessment
This can lead to deletion of important system or application files, causing data loss or service unavailability. The risk is higher if upload management is granted to users with broad permissions.
Recommendation
Update Payload CMS to version 3.90.0 or 4.0.0-canary.34 (or later). Restrict upload management to trusted users and perform regular backups.
Other vulnerabilities in Payload CMS
See all- CVE-2026-105863Critical
Payload CMS in versions after 3.0.0 and before 3.90.0 allows a custom field option that maps a field to a reserved authentication claim name to place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
- CVE-2026-105859Critical
Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to modify collection documents without enforcing collection or field-level access control when orderable is enabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105845Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an untrusted user who can query readable collections through dynamic filters or joins to submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-105844Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an unauthenticated user to submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-63316High
A SQL injection vulnerability was identified in Payload CMS. Improper neutralization of user input in the "in" and "not_in" query parameters allows an authenticated attacker to perform SQL Injection attacks. The issue was fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105868High
In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This leads to JavaScript execution in the victim's browser context.
- CVE-2026-105862High
In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This leads to code execution in the victim's browser.
- CVE-2026-105861High
In Payload CMS versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.
- CVE-2026-105851High
Payload CMS in versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability in the duplicate operation that copies values from a source document even when a field is hidden or its access.read/access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105806High
Payload CMS in @payloadcms/plugin-mcp versions from 3.61.0 to 3.88.0 allows an authenticated user to manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This is fixed in version 3.88.0.
Original NVD description (English source)
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS