# CVE-2022-27952: Payload CMS arbitrary file upload in file module

Source: https://junglewise.ai/threats/cve-2022-27952-payload-cms-arbitrary-file-upload-in-file-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-04-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-27952 · Severity: low · CVSS 3.1 · Published 2022-04-13

Payload CMS is an open-source backend framework and headless CMS platform used to build web applications and content management systems. A vulnerability in versions up to 0.15.0 allows attackers to upload malicious files (such as SVG files) without proper validation, enabling arbitrary code execution on the server and complete system compromise.

Technologies: [payload (npm)](https://junglewise.ai/threats/technologies/payload), [Payload CMS](https://junglewise.ai/threats/technologies/payload-cms). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Payload](https://junglewise.ai/threats/vendors/payload).

## Quick answers

**Is CVE-2022-27952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-27952 being exploited in the wild.

**How severe is CVE-2022-27952?** Low severity, with a CVSS score of 3.1, published 13 April 2022.

**Which products and versions are affected?** payload (npm) SEMVER:introduced=0,fixed=0.15.1; Payload CMS 0.15.0 and earlier.

**Is there a fix for CVE-2022-27952?** Yes. payload (npm): upgrade to 0.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-27952 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-27952?** Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- payload (npm): upgrade to 0.15.1 or later

  ```sh
  npm install payload@0.15.1
  ```


## Technical details

The file upload module in Payload CMS v0.15.0 and earlier fails to properly validate uploaded files, allowing attackers to upload dangerous file types such as SVG files containing embedded code. This is a CWE-434 unrestricted file upload vulnerability. The attack requires no authentication or user interaction and is exploitable remotely over the network. An unauthenticated attacker can upload a crafted SVG file to execute arbitrary code with server privileges. The vulnerability is fixed in version 0.15.1 and later.

## Affected products

- Payload Payload CMS 0.15.0 and earlier

## Identifiers

- CVE-2022-27952
- GHSA-w8xh-93qh-35vw

## Timeline

- 2022-04-13: disclosed
- 2022-04-13: patched: Fix released in version 0.15.1

## References

- [https://github.com/payloadcms/payload](https://github.com/payloadcms/payload)

## Related threats

- [Payload CMS stored XSS in XML upload handling](https://junglewise.ai/threats/cve-2026-105868-payload-is-a-free-and-open-source-headless-content-management)
- [Payload CMS account lockout denial of service](https://junglewise.ai/threats/cve-2026-105866-payload-is-a-free-and-open-source-headless-content-management)
- [Payload CMS path traversal in file deletion](https://junglewise.ai/threats/cve-2026-105865-payload-is-a-free-and-open-source-headless-content-management)
- [Payload CMS authentication token tampering via reserved JWT fields](https://junglewise.ai/threats/cve-2026-105863-payload-is-a-free-and-open-source-headless-content-management)
- [Payload CMS stored XSS in SVG upload sanitization](https://junglewise.ai/threats/cve-2026-105862-payload-is-a-free-and-open-source-headless-content-management)