Executive brief
Payload is a popular open-source CMS and backend framework that handles dynamic database queries. An SQL injection vulnerability in its query input validation allows authenticated attackers to craft malicious requests that can read, modify, or delete data from collections. This could expose sensitive customer data or compromise the integrity of business-critical information stored in the database.
Technical details
The vulnerability is an SQL injection (CWE-89) caused by insufficient validation of request inputs used in query handling. An attacker with authentication credentials can craft requests with specially-crafted query parameters to inject arbitrary SQL commands into the query execution path, potentially reading or modifying data in collections. The attack vector is network-accessible with low attack complexity; authentication is required (PR:L). The fix involves hardening query input validation and is available in Payload v3.79.1 and later. Workarounds include restricting access to affected endpoints to trusted users only and implementing client-side input validation.
Affected products
- Payload Payload < 3.79.1
Timeline
- 2026-04-01: disclosed: Published in GitHub Advisory Database
- 2026-04-01: patched: Fixed in v3.79.1