GHSA-pj5h-5q6c-3pfx CVE-2026-105861
Payload external upload trust validation issue
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.13%
- Chance of exploitation in the next 30 days. Higher than 2.85% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-346 Origin Validation Error
- Fix
3.90.0- Upgrade payload to this version or later
Description
Impact
Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.
You are affected if:
- You have enabled external URL-based upload retrieval, where authenticated requests can trigger it.
Patches
Payload now validates the destination before forwarding authentication data and reapplies that validation when a request changes destination.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
It is recommended to update all Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
If you cannot, a valid workaround exists:
- Disable external URL-based upload retrieval where practical.
- If you cannot disable it, configure the upload header filter to remove authentication data from outbound file requests.
- Restrict access to the affected upload functionality.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| payload | >= 3.0.0, < 3.90.0 |
3.90.0 |
| payload | >= 4.0.0-canary.0, < 4.0.0-canary.34 |
4.0.0-canary.34 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
payload npm → 3.90.0
- npm
npm install payload@3.90.0- yarn
yarn add payload@3.90.0- pnpm
pnpm add payload@3.90.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- Active
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript | High | Also affects payload |
| GHSA-v5gf-vpjc-pc7w Payload: Unauthenticated account-lockout denial of service | High | Also affects payload |
| GHSA-p223-2wr2-j562 Payload: Incomplete validation during the upload file lifecycle | High | Also affects payload |
| GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue | Critical | Also affects payload |
| GHSA-2pwp-2369-8fg3 Payload: Bypassed sanitization of user uploaded SVGs | High | Also affects payload |
| GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents | Critical | Also affects payload |
| GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register | High | Also affects payload |
| GHSA-fx49-4h83-wjv9 Payload didn't enforce field-level password update restrictions | High | Also affects payload |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor