CVE-2026-105856

Published: Oct 6, 2026Modified: Oct 15, 2026

8.6

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.

Affected (35)

Products: Payloadcms: Payload

Payloadcms

1 product

Payload

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Payloadcms Payload	version < 3.90.0
Payloadcms Payload	Version 4.0.0 canary0
Payloadcms Payload	Version 4.0.0 canary10
Payloadcms Payload	Version 4.0.0 canary11
Payloadcms Payload	Version 4.0.0 canary12
Payloadcms Payload	Version 4.0.0 canary13
Payloadcms Payload	Version 4.0.0 canary14
Payloadcms Payload	Version 4.0.0 canary15
Payloadcms Payload	Version 4.0.0 canary16
Payloadcms Payload	Version 4.0.0 canary17
Payloadcms Payload	Version 4.0.0 canary18
Payloadcms Payload	Version 4.0.0 canary19
Payloadcms Payload	Version 4.0.0 canary1
Payloadcms Payload	Version 4.0.0 canary20
Payloadcms Payload	Version 4.0.0 canary21
Payloadcms Payload	Version 4.0.0 canary22
Payloadcms Payload	Version 4.0.0 canary23
Payloadcms Payload	Version 4.0.0 canary24
Payloadcms Payload	Version 4.0.0 canary25
Payloadcms Payload	Version 4.0.0 canary26
Payloadcms Payload	Version 4.0.0 canary27
Payloadcms Payload	Version 4.0.0 canary28
Payloadcms Payload	Version 4.0.0 canary29
Payloadcms Payload	Version 4.0.0 canary2
Payloadcms Payload	Version 4.0.0 canary30
Payloadcms Payload	Version 4.0.0 canary31
Payloadcms Payload	Version 4.0.0 canary32
Payloadcms Payload	Version 4.0.0 canary33
Payloadcms Payload	Version 4.0.0 canary3
Payloadcms Payload	Version 4.0.0 canary4
Payloadcms Payload	Version 4.0.0 canary5
Payloadcms Payload	Version 4.0.0 canary6
Payloadcms Payload	Version 4.0.0 canary7
Payloadcms Payload	Version 4.0.0 canary8
Payloadcms Payload	Version 4.0.0 canary9

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (3)

https://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc

Source: security-advisories@github.com

Patch

https://github.com/payloadcms/payload/releases/tag/v3.90.0

Source: security-advisories@github.com

PatchRelease Notes

https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.