What’s Vulnerable › Vulnerabilities

CVE-2026-105856: Payload: SQL injection in SQLite/Postgres

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-15
• Weakness: CWE-89

Description

Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.

Affected products

• payloadcms payload: before 3.90.0; 4.0.0-canary0, 4.0.0-canary1, 4.0.0-canary10, 4.0.0-canary11, 4.0.0-canary12, 4.0.0-canary13 (+28) — fixed in 3.90.0

How to fix

Upgrade to a fixed version: payloadcms payload 3.90.0. Check the vendor advisory for mitigations.

References

• https://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp

Get alerted when CVE-2026-105856 or the next vulnerability affects your stack