In short
- CVE-2026-105858 is a HIGH (CVSS 8.1) vulnerability affecting payload (payloadcms), payload.
- Chance of exploitation in the next 30 days (EPSS): 0.47%, higher than 41.1% of all vulnerabilities.
- Fix: update to 3.90.0, 4.0.0-canary.34 or later.
| Package | Affected versions | Patched versions |
|---|
| payload | = 4.0.0< 3.90.0
| 3.90.0
|
| payload npm | ≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0
| 4.0.0-canary.343.90.0
|
Description
Impact
A crafted request to the public first-register operation can be used to perform a RCE exploit.
You are affected if:
- You use local auth strategy and your application remains without an initial user created
Patches
In the patched version data submission to create first user is properly sanitized.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
NVD description
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free