Executive brief
Payload CMS allows users to upload files to cloud storage (AWS S3, Google Cloud Storage, Azure, or Cloudflare R2) using signed URLs. The file upload endpoints do not properly validate filenames, allowing an attacker to craft malicious filenames that escape the intended storage directory and write files to unauthorized locations. This could allow a logged-in attacker to overwrite or place files outside their intended upload area, potentially compromising data integrity or enabling further attacks.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 storage adapters. The root cause is insufficient filename sanitization that fails to prevent directory traversal sequences in filenames. An attacker with network access to these endpoints and valid user credentials (low privilege) can supply crafted filenames containing path traversal characters to escape the intended storage bucket/directory. Successful exploitation allows modification of file integrity by writing files to unintended locations. The vulnerability affects all versions before v3.78.0, which hardened filename validation. A patch is available; as a temporary workaround, access to these endpoints should be restricted to trusted users.
Affected products
- Payload @payloadcms/storage-s3 < 3.78.0
- Payload @payloadcms/storage-gcs < 3.78.0
- Payload @payloadcms/storage-azure < 3.78.0
- Payload @payloadcms/storage-r2 < 3.78.0
Timeline
- 2026-04-01: disclosed: Vulnerability published via GitHub Security Advisory
- 2026-04-01: patched: Fix released in v3.78.0