GitHub Advisoryadvisory · npm

GHSA-6r7f-q7f5-wpx8 Payload has Authenticated SSRF via Upload Functionality

HIGH Published 2026-04-01 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-34746
Ecosystem
npm
Packages
payload
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2026-04-01

Affected packages

• npm payload: < 3.79.1 → fixed in 3.79.1

Description

Impact An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality. Authenticated users with `create` or `update` access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. Consumers are affected if ALL of these are true: • Payload version < v3.79.1 • At least one collection with `upload` enabled • An authenticated user has `create` or `update` access to that collection Patches This vulnerability has been patched in v3.79.1. Users should upgrade to v3.79.1 or later. Workarounds Until consumers can upgrade: • Restrict `create` and `update` access to upload-enabled collections to trusted roles only. • Limit outbound network access from your Payload server where possible.

Related

Alias · CVE (1)

  • CVE-2026-34746 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References