En resumen
- CVE-2026-105858 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a payload (payloadcms), payload.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.47%, mayor que el 41.1% de las vulnerabilidades.
- Solución: actualizar a 3.90.0, 4.0.0-canary.34 o posterior.
| Package | Affected versions | Patched versions |
|---|
| payload | = 4.0.0< 3.90.0
| 3.90.0
|
| payload npm | ≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0
| 4.0.0-canary.343.90.0
|
Description
Impact
A crafted request to the public first-register operation can be used to perform a RCE exploit.
You are affected if:
- You use local auth strategy and your application remains without an initial user created
Patches
In the patched version data submission to create first user is properly sanitized.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
NVD description
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free