EUVD-2026-93513

Payload: Client uploads could overwrite S3 objects...

@ainsleydev/payload-helper (0.0.16), @contentql/core (>=0.1.2, <=0.3.5) +5 more potentially affected by CVE-2026-105868 via @payloadcms/storage-s3 (>=3.0.0-beta.29, <=3.89.0)

@payloadcms/storage-s3 NPM version =3.0.0-beta.29, =0.1.2, =0.0.1, =0.1.0, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-105868 Source advisory: SNYK:JS-PAYLOADCMSSTORAGES3-20570543...

@adenta/cms (>=0.0.6, <=1.1.1-0), @otherdev-software/canvas (1.0.0) potentially affected by CVE-2026-105868 via @payloadcms/payload-cloud (>=3.53.0, <=3.61.0)

@payloadcms/payload-cloud NPM version =3.53.0, =0.0.6, =1.1.1-0 - @otherdev-software/canvas 1.0.0 Source cves: CVE-2026-105868 Source advisory: SNYK:JS-PAYLOADCMSPAYLOADCLOUD-20570538...

@frogbotai/storage-gcs (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105868 via @payloadcms/storage-gcs (>=3.85.1, <=3.88.0)

@payloadcms/storage-gcs NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105868 Source advisory: SNYK:JS-PAYLOADCMSSTORAGEGCS-20570541...

@frogbotai/storage-azure (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105868 via @payloadcms/storage-azure (>=3.85.1, <=3.88.0)

@payloadcms/storage-azure NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105868 Source advisory: SNYK:JS-PAYLOADCMSSTORAGEAZURE-20570540...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105868 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105868 Source advisory: OSV:GHSA-9QPG-3CF8-W33X...

Arbitrary File Upload

Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...

Arbitrary File Upload

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relat...

Arbitrary File Upload

Overview @payloadcms/storage-s3 is a Payload storage adapter for Amazon S3 Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...

Arbitrary File Upload

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData an...

Arbitrary File Upload

Overview @payloadcms/storage-azure is a Payload storage adapter for Azure Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relat...

Arbitrary File Upload

Overview @payloadcms/storage-uploadthing is a Payload storage adapter for uploadthing Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relate...

EUVD-2026-93501

Payload Form Builder has an RCE issue...

Payload Form Builder has an RCE issue

Impact A vulnerability in @payloadcms/plugin-form-builder in versions = 3.90.0 or = 4.0.0-canary.34...

GHSA-R488-J9VJ-WX3Q Payload Form Builder has an RCE issue

Impact A vulnerability in @payloadcms/plugin-form-builder in versions = 3.90.0 or = 4.0.0-canary.34...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105859 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105859 Source advisory: OSV:GHSA-F7HX-52Q9-HCRF...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105859 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105859 Source advisory: SNYK:JS-PAYLOAD-20571316...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105859 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105859 Source advisory: GHSA-F7HX-52Q9-HCRF...

Exploit for CVE-2026-105844

CVE-2026-105844 — Payload CMS import-export prototype pollutio...

GHSA-4WW4-68Q3-H7G5 Payload: Field-level write access bypass in Payload on MongoDB

Impact A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update. You are affected if: Payload version 3.87.0 or a 4.0.0-canary release before 4.0.0-canary.20 using the MongoDB adapter...