En bref
- CVE-2026-34746 est une vulnérabilité ÉLEVÉE (CVSS 7.7) touchant payload (payloadcms), payload.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.31%, plus élevée que 23.6% des vulnérabilités.
- Correctif : mettre à jour vers 3.79.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| payload | < 3.79.1
| 3.79.1
|
| payload npm | < 3.79.1
| 3.79.1
|
Description
Impact
An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.
Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.
Consumers are affected if ALL of these are true:
- Payload version < v3.79.1
- At least one collection with
upload enabled
- An authenticated user has
create or update access to that collection
Patches
This vulnerability has been patched in v3.79.1. Users should upgrade to v3.79.1 or later.
Workarounds
Until consumers can upgrade:
- Restrict
create and update access to upload-enabled collections to trusted roles only.
- Limit outbound network access from your Payload server where possible.
NVD description
Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free