Tóm tắt nhanh
- CVE-2026-34746 là lỗ hổng mức CAO (CVSS 7.7) ảnh hưởng payload (payloadcms), payload.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.31%, cao hơn 23.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 3.79.1 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| payload | < 3.79.1
| 3.79.1
|
| payload npm | < 3.79.1
| 3.79.1
|
Mô tả
Impact
An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.
Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.
Consumers are affected if ALL of these are true:
- Payload version < v3.79.1
- At least one collection with
upload enabled
- An authenticated user has
create or update access to that collection
Patches
This vulnerability has been patched in v3.79.1. Users should upgrade to v3.79.1 or later.
Workarounds
Until consumers can upgrade:
- Restrict
create and update access to upload-enabled collections to trusted roles only.
- Limit outbound network access from your Payload server where possible.
Mô tả của NVD
Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí