Executive brief
Payload is an open-source headless CMS used to manage and deliver content. An authenticated user with permission to upload files to a collection could exploit this vulnerability to trick the server into making HTTP requests to arbitrary internal or external URLs, potentially exposing sensitive internal services or data.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in Payload's upload functionality that allows authenticated users to cause the server to make outbound HTTP requests to arbitrary URLs. The attack requires authentication and valid create or update access to an upload-enabled collection, with no user interaction required. An attacker can leverage this to access internal services, exfiltrate data, or interact with restricted network resources. The vulnerability has been patched in version 3.79.1; users must upgrade immediately to remediate.
Affected products
- Payload Payload CMS < 3.79.1
Timeline
- 2026-04-01: disclosed: Vulnerability published as GHSA-6r7f-q7f5-wpx8
- 2026-04-01: patched: Fix released in version 3.79.1