Executive brief
The Payload Cloudinary plugin is a library that integrates with the Cloudinary media hosting service to handle image and file uploads. A vulnerability in versions 0.3.0-0.3.4 allows any authenticated user to obtain valid cryptographic signatures for arbitrary Cloudinary upload parameters, bypassing intended controls. An attacker could overwrite existing files, change asset visibility, redirect webhooks for data exfiltration, or traverse directories—compromising the integrity and confidentiality of media assets stored in the configured Cloudinary account.
Technical details
The vulnerability is an improper input validation / authorization flaw in the server-side signature generation endpoint (POST /api/cloudinary-generate-signature). The vulnerable code at getGenerateSignature.ts:46-55 accepts attacker-controlled paramsToSign from the request body and passes it directly to cloudinary.utils.api_sign_request() without any allowlist, key filtering, folder/public_id policy enforcement, or timestamp freshness validation. Authentication requires only a valid Payload user session (!!req.user check). An attacker can craft malicious parameter sets including overwrite=true, type=private, notification_url, or path-traversal sequences, obtain a mathematically valid HMAC-SHA1 signature, and replay it directly to Cloudinary's API to perform unauthorized asset operations. The vulnerability was patched in version 0.4.0 by implementing parameter allowlisting and policy enforcement.
Affected products
- JHB Software payload-cloudinary-plugin >=0.3.0, <0.4.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: patched: Version 0.4.0 released with allowlist and policy enforcement