GHSA-6r7f-q7f5-wpx8 CVE-2026-34746

Payload has Authenticated SSRF via Upload Functionality

High npm

Severity: 7.7 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.31%; Chance of exploitation in the next 30 days. Higher than 23.59% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-918 Server-Side Request Forgery (SSRF)
Fix: 3.79.1; Upgrade payload to this version or later

Description

Impact

An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.

Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.

Consumers are affected if ALL of these are true:

Payload version < v3.79.1
At least one collection with upload enabled
An authenticated user has create or update access to that collection

Patches

This vulnerability has been patched in v3.79.1. Users should upgrade to v3.79.1 or later.

Workarounds

Until consumers can upgrade:

Restrict create and update access to upload-enabled collections to trusted roles only.
Limit outbound network access from your Payload server where possible.

Affected versions

npm

Package	Vulnerable	Fixed in
payload	`< 3.79.1`	`3.79.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

payload npm → `3.79.1`

npm

npm install payload@3.79.1

yarn

yarn add payload@3.79.1

pnpm

pnpm add payload@3.79.1

Severity breakdown

CVSS 3.1 7.7

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-34746

Packages

github.com/payloadcms/payload

Timeline

Apr 1, 2026 Published
Oct 26, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript	High	Also affects payload
GHSA-v5gf-vpjc-pc7w Payload: Unauthenticated account-lockout denial of service	High	Also affects payload
GHSA-p223-2wr2-j562 Payload: Incomplete validation during the upload file lifecycle	High	Also affects payload
GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue	Critical	Also affects payload
GHSA-2pwp-2369-8fg3 Payload: Bypassed sanitization of user uploaded SVGs	High	Also affects payload
GHSA-pj5h-5q6c-3pfx Payload external upload trust validation issue	High	Also affects payload
GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents	Critical	Also affects payload
GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register	High	Also affects payload

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor