要点
- CVE-2026-34746 は payload (payloadcms), payload に影響する深刻度「高」 (CVSS 7.7) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.31%（全脆弱性の 23.6% より高い）。
- 対処：3.79.1 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| payload | < 3.79.1
| 3.79.1
|
| payload npm | < 3.79.1
| 3.79.1
|
概要
Impact
An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.
Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.
Consumers are affected if ALL of these are true:
- Payload version < v3.79.1
- At least one collection with
upload enabled
- An authenticated user has
create or update access to that collection
Patches
This vulnerability has been patched in v3.79.1. Users should upgrade to v3.79.1 or later.
Workarounds
Until consumers can upgrade:
- Restrict
create and update access to upload-enabled collections to trusted roles only.
- Limit outbound network access from your Payload server where possible.
NVD の説明
Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン