CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/payloadcms/payload/commit/333b82b9f3e685fed6826c2e3270da79df8336c6	Patch
https://github.com/payloadcms/payload/releases/tag/v3.90.0	Patch Release Notes
https://github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:payloadcms:payload::::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary0::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary1::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary10::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary11::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary12::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary13::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary14::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary15::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary16::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary17::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary18::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary19::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary2::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary20::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary21::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary22::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary23::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary24::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary25::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary26::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary27::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary28::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary29::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary3::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary30::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary31::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary32::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary33::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary4::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary5::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary6::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary7::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary8::::node.js::*
	cpe:2.3:a:payloadcms:payload:4.0.0:canary9::::node.js::*

History

15 Oct 2026, 00:11

Type	Values Removed	Values Added
References	~~() https://github.com/payloadcms/payload/commit/333b82b9f3e685fed6826c2e3270da79df8336c6 -~~	() https://github.com/payloadcms/payload/commit/333b82b9f3e685fed6826c2e3270da79df8336c6 - Patch
References	~~() https://github.com/payloadcms/payload/releases/tag/v3.90.0 -~~	() https://github.com/payloadcms/payload/releases/tag/v3.90.0 - Patch, Release Notes
References	~~() https://github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q -~~	() https://github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q - Vendor Advisory
First Time		Payloadcms payload Payloadcms
CPE		cpe:2.3:a:payloadcms:payload:4.0.0:canary17::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary27::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary30::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary28::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary2::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary7::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary8::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary21::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary11::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary26::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary31::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary15::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary5::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary10::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary12::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary13::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary32::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary24::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary20::::node.js::* cpe:2.3:a:payloadcms:payload::::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary23::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary22::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary29::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary25::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary6::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary33::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary3::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary9::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary0::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary14::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary19::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary18::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary1::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary4::::node.js::* cpe:2.3:a:payloadcms:payload:4.0.0:canary16::::node.js::*

06 Oct 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-06 17:17

Updated : 2026-10-15 00:11

NVD link : CVE-2026-105857

Mitre link : CVE-2026-105857

CVE.ORG link : CVE-2026-105857

JSON object : View

Products Affected

payloadcms

payload

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')