GHSA-hhfx-5x8j-f5f6 CVE-2026-27567
Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.34%
- Chance of exploitation in the next 30 days. Higher than 26.94% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
3.75.0- Upgrade payload to this version or later
Description
Impact
A Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources.
Users are affected if ALL of these are true:
- Payload version < v3.75.0
- At least one collection with
uploadenabled - A user has
createaccess to that upload-enabled collection
An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application.
Patches
This vulnerability has been patched in v3.75.0. Users should upgrade to v3.75.0 or later.
Workarounds
If users cannot upgrade immediately, they can mitigate this vulnerability by disabling external file uploads via the disableExternalFile upload collection option, or by restricting create access on upload-enabled collections to trusted users only.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| payload | < 3.75.0 |
3.75.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
payload npm → 3.75.0
- npm
npm install payload@3.75.0- yarn
yarn add payload@3.75.0- pnpm
pnpm add payload@3.75.0
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript | High | Also affects payload |
| GHSA-v5gf-vpjc-pc7w Payload: Unauthenticated account-lockout denial of service | High | Also affects payload |
| GHSA-p223-2wr2-j562 Payload: Incomplete validation during the upload file lifecycle | High | Also affects payload |
| GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue | Critical | Also affects payload |
| GHSA-2pwp-2369-8fg3 Payload: Bypassed sanitization of user uploaded SVGs | High | Also affects payload |
| GHSA-pj5h-5q6c-3pfx Payload external upload trust validation issue | High | Also affects payload |
| GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents | Critical | Also affects payload |
| GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register | High | Also affects payload |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor