CVE-2026-34746

Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/payloadcms/payload/releases/tag/v3.79.1	Product Release Notes
https://github.com/payloadcms/payload/security/advisories/GHSA-6r7f-q7f5-wpx8	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Payload es un sistema de gestión de contenidos sin interfaz, gratuito y de código abierto. Antes de la versión 3.79.1, existe una vulnerabilidad autenticada de falsificación de petición del lado del servidor (SSRF) en la funcionalidad de carga. Los usuarios autenticados con acceso de creación o actualización a una colección con carga habilitada podrían hacer que el servidor realice peticiones HTTP salientes a URL arbitrarias. Este problema ha sido parcheado en la versión 3.79.1.

Information

Published : 2026-04-01 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34746

Mitre link : CVE-2026-34746

CVE.ORG link : CVE-2026-34746

JSON object : View

Products Affected

payloadcms

payload

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-34746", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34746", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T15:10:39.687505Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "payloadcms", "product": "payload", "versions": [{"status": "affected", "version": "< 3.79.1"}]}]}], "published": "2026-04-01T20:16:26.727", "references": [{"url": "https://github.com/payloadcms/payload/releases/tag/v3.79.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-6r7f-q7f5-wpx8", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1."}, {"lang": "es", "value": "Payload es un sistema de gesti\u00f3n de contenidos sin interfaz, gratuito y de c\u00f3digo abierto. Antes de la versi\u00f3n 3.79.1, existe una vulnerabilidad autenticada de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en la funcionalidad de carga. Los usuarios autenticados con acceso de creaci\u00f3n o actualizaci\u00f3n a una colecci\u00f3n con carga habilitada podr\u00edan hacer que el servidor realice peticiones HTTP salientes a URL arbitrarias. Este problema ha sido parcheado en la versi\u00f3n 3.79.1."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B4AE65F8-450D-4573-9CD7-1AA42CE5DC28", "versionEndExcluding": "3.79.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}