CVE-2026-105867: @payloadcms/storage-s3 Client Uploads Vulnerability Leading to S3 Object Overwrites
Summary
CVE-2026-105867: Payload: Client uploads could overwrite S3 objects. Affects @payloadcms/storage-s3 across 2 version ranges.
< 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @payloadcms/storage-s3 package is a storage solution for Payload CMS that integrates with Amazon S3, allowing users to upload and manage files in a cloud environment. It provides functionalities such as file validation and access control for uploaded content. However, a vulnerability exists that allows authenticated users to overwrite existing S3 objects in collections that share the same S3 bucket, potentially leading to unauthorized access and data integrity issues.
Vulnerability Detail
The vulnerability arises when client uploads are enabled for multiple collections that share an S3 bucket, and the 'useCompositePrefixes' configuration is either not set or set to false. This misconfiguration allows an authenticated user to bypass access controls and overwrite files belonging to other collections, leading to potential data loss and unauthorized file manipulation.
How To Fix
Latest published version: 3.91.0 as of 22 Oct 2026
npm install @payloadcms/storage-s3@3.91.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.90.03.90.0npm install @payloadcms/storage-s3@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install @payloadcms/storage-s3@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, disable client uploads until you can upgrade to the patched version. This can be done by modifying the configuration settings in your Payload CMS setup to prevent any file uploads.
Conclusion
The vulnerability identified as CVE-2026-105867 in the @payloadcms/storage-s3 package poses a significant risk by allowing authenticated users to overwrite S3 objects across collections. It is essential to upgrade to the patched versions or implement workarounds to safeguard your application from potential data breaches.
See every vulnerability recorded for @payloadcms/storage-s3 →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
Failing to address this vulnerability may lead to unauthorized access to sensitive files, data loss, and potential exploitation of your application by malicious users.
Yes, configuring 'useCompositePrefixes' to true can help mitigate the risk by ensuring that uploads are properly isolated between collections.
If an immediate upgrade is not possible, it is crucial to disable client uploads as a temporary workaround to prevent potential exploitation.
