Cross-site Scripting (XSS)

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker c...

@frogbotai/storage-gcs (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105868 via @payloadcms/storage-gcs (>=3.85.1, <=3.88.0)

@payloadcms/storage-gcs NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105868 Source advisory: SNYK:JS-PAYLOADCMSSTORAGEGCS-20570541...

Arbitrary File Upload

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relat...

CVE-2026-34750

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...

CVE-2026-34750: Improper Limitation of a Pathname to a Restricted Directory

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...