Executive brief
Payload CMS is an open-source backend framework and headless CMS platform used to build web applications and content management systems. A vulnerability in versions up to 0.15.0 allows attackers to upload malicious files (such as SVG files) without proper validation, enabling arbitrary code execution on the server and complete system compromise.
Technical details
The file upload module in Payload CMS v0.15.0 and earlier fails to properly validate uploaded files, allowing attackers to upload dangerous file types such as SVG files containing embedded code. This is a CWE-434 unrestricted file upload vulnerability. The attack requires no authentication or user interaction and is exploitable remotely over the network. An unauthenticated attacker can upload a crafted SVG file to execute arbitrary code with server privileges. The vulnerability is fixed in version 0.15.1 and later.
Affected products
- Payload Payload CMS 0.15.0 and earlier
Timeline
- 2022-04-13: disclosed
- 2022-04-13: patched: Fix released in version 0.15.1