Executive brief
A vulnerability in the Cloudinary plugin for Payload CMS allows any logged-in user to generate valid security signatures for the Cloudinary media service. This allows an attacker to bypass security controls to overwrite existing files, change file privacy settings, or trigger unauthorized web requests. In practice, this could lead to website defacement or the exposure of private media assets.
Technical details
The vulnerability exists in the `getGenerateSignature.ts` component of the `@jhb.software/payload-cloudinary-plugin`. When `clientUploads` is enabled, the plugin exposes a `POST /api/cloudinary-generate-signature` endpoint that accepts a `paramsToSign` object from the request body. This object is passed directly to the `cloudinary.utils.api_sign_request` function without validation, allowlisting, or policy enforcement. An authenticated attacker can use this endpoint as a signature oracle to generate valid HMAC-SHA1 signatures for any Cloudinary upload parameters, including `overwrite`, `notification_url` (SSRF), and path traversal sequences in the `folder` parameter. This allows for unauthorized asset replacement, access control bypass, and data exfiltration via webhooks. The issue is patched in version 0.4.0.
Affected products
- jhb-software @jhb.software/payload-cloudinary-plugin >= 0.3.0, < 0.4.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 0.4.0: patched