CVE-2026-34750

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/payloadcms/payload/security/advisories/GHSA-frq9-7j6g-v74x	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Payload es un sistema de gestión de contenido sin interfaz de código abierto y gratuito. Antes de la versión 3.78.0 en @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2 y @payloadcms/storage-s3, los puntos finales de URL firmadas para carga de cliente para S3, GCS, Azure y R2 no saneaban correctamente los nombres de archivo. Un atacante podría crear nombres de archivo para escapar de la ubicación de almacenamiento prevista. Este problema ha sido parcheado en la versión 3.78.0 para @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2 y @payloadcms/storage-s3.

Information

Published : 2026-04-01 20:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-34750

Mitre link : CVE-2026-34750

CVE.ORG link : CVE-2026-34750

JSON object : View

Products Affected

payloadcms

payload

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-34750", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34750", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T15:33:26.614791Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "payloadcms", "product": "payload", "versions": [{"status": "affected", "version": "< 3.78.0"}]}]}], "published": "2026-04-01T20:16:27.337", "references": [{"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-frq9-7j6g-v74x", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3."}, {"lang": "es", "value": "Payload es un sistema de gesti\u00f3n de contenido sin interfaz de c\u00f3digo abierto y gratuito. Antes de la versi\u00f3n 3.78.0 en @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2 y @payloadcms/storage-s3, los puntos finales de URL firmadas para carga de cliente para S3, GCS, Azure y R2 no saneaban correctamente los nombres de archivo. Un atacante podr\u00eda crear nombres de archivo para escapar de la ubicaci\u00f3n de almacenamiento prevista. Este problema ha sido parcheado en la versi\u00f3n 3.78.0 para @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2 y @payloadcms/storage-s3."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "225E9788-C205-479C-B3EE-7A57A468929F", "versionEndExcluding": "3.78.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}