CVE-2026-27567: Payload Server-Side Request Forgery (SSRF) Vulnerability in External File Uploads
Summary
CVE-2026-27567: Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads. Affects payload versions < 3.75.0. Fixed in 3.75.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Payload is an open-source content management system built on Node.js, designed for creating and managing web applications with ease. It offers features such as customizable collections, file uploads, and a user-friendly interface. However, it has a vulnerability in its external file upload functionality, which can be exploited if proper security measures are not implemented.
Vulnerability Detail
The vulnerability arises from insufficient validation of HTTP redirects when processing external URLs for file uploads. This Server-Side Request Forgery (SSRF) flaw allows an authenticated attacker to potentially access internal network resources. If an attacker has write permissions to an upload-enabled collection, they could retrieve sensitive response content from internal services through the application, leading to unauthorized access and data exposure.
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.75.0
This is the first release that contains the fix.
npm install payload@3.75.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, users can mitigate the vulnerability by disabling external file uploads. This can be achieved by setting the disableExternalFile option in the upload collection configuration to true. Additionally, restrict create access on upload-enabled collections to trusted users only.
Conclusion
In summary, the CVE-2026-27567 vulnerability in Payload poses a significant risk due to its SSRF nature, allowing unauthorized access to internal resources. Users are strongly advised to upgrade to version 3.75.0 or later to mitigate this risk. If an upgrade is not possible, implementing the suggested workarounds can help protect against potential exploitation.
See every vulnerability recorded for payload →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate level of risk.
Users of Payload versions prior to 3.75.0 with at least one upload-enabled collection and users having create access to that collection are affected.
An attacker could access internal network resources and retrieve sensitive information from internal services through the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade immediately, disable external file uploads and restrict create access on upload-enabled collections to trusted users only.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
