In short
- CVE-2026-34746 is a HIGH (CVSS 7.7) vulnerability affecting payload (payloadcms), payload.
- Chance of exploitation in the next 30 days (EPSS): 0.31%, higher than 23.6% of all vulnerabilities.
- Fix: update to 3.79.1 or later.
| Package | Affected versions | Patched versions |
|---|
| payload | < 3.79.1
| 3.79.1
|
| payload npm | < 3.79.1
| 3.79.1
|
Description
Impact
An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.
Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.
Consumers are affected if ALL of these are true:
- Payload version < v3.79.1
- At least one collection with
upload enabled
- An authenticated user has
create or update access to that collection
Patches
This vulnerability has been patched in v3.79.1. Users should upgrade to v3.79.1 or later.
Workarounds
Until consumers can upgrade:
- Restrict
create and update access to upload-enabled collections to trusted roles only.
- Limit outbound network access from your Payload server where possible.
NVD description
Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free