CVE-2026-105861: Payload Package External Upload Trust Validation Issue
Summary
CVE-2026-105861: Payload external upload trust validation issue. Affects payload across 2 version ranges.
>= 3.0.0, < 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Payload is an open-source content management system designed for building custom applications. It provides a flexible framework for managing content and supports various external upload configurations. However, it has a vulnerability that could lead to unauthorized exposure of authentication data when external URL-based upload retrieval is enabled.
Vulnerability Detail
The vulnerability arises from Payload's handling of external uploads, where it fails to validate the trustworthiness of the destination before sending authentication data. This flaw can lead to the exposure of valid session information to unintended recipients, especially if the affected request is authenticated. The issue is particularly concerning for users who have enabled external URL-based upload retrieval, as it can compromise the security of their sessions.
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.90.03.90.0npm install payload@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install payload@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately feasible, users can implement the following workarounds: 1. Disable external URL-based upload retrieval where possible. 2. If disabling is not an option, configure the upload header filter to remove authentication data from outbound file requests. 3. Restrict access to the affected upload functionality to minimize risk.
Conclusion
In summary, CVE-2026-105861 represents a significant vulnerability in the Payload package that can lead to the exposure of sensitive authentication data. Users are strongly advised to upgrade to the patched versions or implement the recommended workarounds to mitigate risks.
See every vulnerability recorded for payload →
FAQ
CVE-2026-105861 is a vulnerability in the Payload package that allows for the potential exposure of authentication data due to insufficient validation of external upload destinations.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner without any signup.
The primary risk is the exposure of valid session information to unauthorized recipients, which can lead to unauthorized access and data breaches.
If an immediate upgrade is not possible, consider disabling external URL-based upload retrieval or configuring the upload header filter to remove authentication data.
The CVSS score for this vulnerability is 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
