Payload: Remote Code Execution through first-register

CAO 8.1CVE-2026-105858 · GHSA-97rh-rhh2-7vjv · Công bố 06/10/2026 · cập nhật 15/10/2026

Tóm tắt nhanh

CVE-2026-105858 là lỗ hổng mức CAO (CVSS 8.1) ảnh hưởng payload (payloadcms), payload.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.47%, cao hơn 41.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.90.0, 4.0.0-canary.34 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
payload payloadcms	`= 4.0.0< 3.90.0`	`3.90.0`
payload npm	`≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0`	`4.0.0-canary.343.90.0`

Mô tả

Impact

A crafted request to the public first-register operation can be used to perform a RCE exploit.

You are affected if:

You use local auth strategy and your application remains without an initial user created

Patches

In the patched version data submission to create first user is properly sanitized.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Mô tả của NVD

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.