@01.software/sdk (>=0.0.1-251008.90016 <=0.1.4), @adenta/cms (>=0.0.6 <=1.1.1-0) +76 more potentially affected by CVE-2026-27567 via payload (>=0.12.3 <=3.75.0-internal.8e0f8ba)

payload NPM version =0.12.3, =0.0.1-251008.90016, =0.0.6, =0.0.1, =1.0.1-beta.0, =1.0.1, =1.0.0, =1.0.6, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.0.17 and more Source cves: CVE-2026-27567 Source advisory: OSV:GHSA-HHFX-5X8J-F5F6...

CVE-2026-27567

Payload CMS (free, open source headless) prior to v3.75.0 contains an SSRF in external file URL uploads. When processing external URLs, insufficient validation of HTTP redirects can allow an authenticated user with upload permissions (needs a collection with upload enabled and create access) to c...