CVE-2026-105865

Description

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Traduire en français

Produits concernés

• payloadcms payload

Scores CVSS

Faiblesses (CWE)

• CWE-22
• CWE-73

Références

• https://github.com/payloadcms/payload/commit/6b74418f628fa633c2f297e5919a9f91b383dc11 Patch
• https://github.com/payloadcms/payload/releases/tag/v3.90.0 PatchRelease Notes
• https://github.com/payloadcms/payload/security/advisories/GHSA-p223-2wr2-j562 Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories