Is CVE-2026-34748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34748 being exploited in the wild.

How severe is CVE-2026-34748?

High severity, with a CVSS score of 8.7, published 1 April 2026.

Which products and versions are affected?

@payloadcms/next (npm) SEMVER:introduced=0,fixed=3.78.0.

Is there a fix for CVE-2026-34748?

Yes. @payloadcms/next (npm): upgrade to 3.78.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34748 attacked?

It is attacked over the network.

Am I affected by CVE-2026-34748?

Check whether you run @payloadcms/next (npm) or PayloadCMS Payload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34748: Payload @payloadcms/next stored XSS in admin panel

CVE-2026-34748 · Severity: high · CVSS 8.7 · Published 2026-04-01

@payloadcms/next is a headless CMS framework used to build admin interfaces and manage content. A stored cross-site scripting vulnerability in the admin panel allows authenticated users with write access to versioned collections to inject malicious JavaScript that executes when other users view that content, potentially leading to account compromise or data theft.

Technologies: @payloadcms/next (npm), PayloadCMS Payload. Vendors: npm, PayloadCMS.

Quick answers

Is CVE-2026-34748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34748 being exploited in the wild.
How severe is CVE-2026-34748?: High severity, with a CVSS score of 8.7, published 1 April 2026.
Which products and versions are affected?: @payloadcms/next (npm) SEMVER:introduced=0,fixed=3.78.0.
Is there a fix for CVE-2026-34748?: Yes. @payloadcms/next (npm): upgrade to 3.78.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34748 attacked?: It is attacked over the network.
Am I affected by CVE-2026-34748?: Check whether you run @payloadcms/next (npm) or PayloadCMS Payload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@payloadcms/next (npm): upgrade to 3.78.0 or later
```
npm install @payloadcms/next@3.78.0
```

Technical details

The vulnerability is a stored XSS (CWE-79) in the admin panel of @payloadcms/next versions before 3.78.0. An authenticated user with create or update permissions on a collection with versioning enabled can save malicious JavaScript in content fields. When another user views this content, the unencoded output allows the script to execute in their browser context, potentially granting access to sensitive data or admin functionality. The attack requires network access, valid credentials, and user interaction (victim viewing the affected content). The fix involves adding output encoding to prevent user-supplied content from being interpreted as markup. Patch is available in v3.78.0 and later.

Affected products

Payload @payloadcms/next < 3.78.0

Identifiers

CVE-2026-34748
GHSA-mmxc-95ch-2j7c

Timeline

2026-04-01: disclosed: GHSA-mmxc-95ch-2j7c published
2026-03-30: patched: Patch released in v3.78.0

References

https://github.com/payloadcms/payload/security/advisories/GHSA-mmxc-95ch-2j7c

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.