TI-2026-21961 Aliases CVE-2026-27567 GHSA-hhfx-5x8j-f5f6

Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads

LOW 31CWE-918Published 2026-02-24 · Updated 2026-02-27

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at least one collection with `upload` enabled and a user who has `create` access to that upload-enabled collection in order to be vulnerable. An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application. This vulnerability has been patched in v3.75.0. As a workaround, one may mitigate this vulnerability by disabling external file uploads via the `disableExternalFile` upload collection option, or by restricting `create` access on upload-enabled collections to trusted users only.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00335 27th percentileScored 2026-11-07

Fix Fixed payload (payloadcms): 3.75.0payload (npm): 3.75.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
payloadcms	payload	before 3.75.0	3.75.0	Patch available	CNA
—	payload (npm)	before 3.75.0	3.75.0	Patch available	GHSA-hhfx-5x8j-f5f6

payload Vendorpayloadcms Affected before 3.75.0 Fixed in 3.75.0 Patch available CNA
payload (npm) Vendor— Affected before 3.75.0 Fixed in 3.75.0 Patch available GHSA-hhfx-5x8j-f5f6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:payloadcms:payload::::::node.js::*	before 3.75.0	Vulnerable	payloadcms

cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* Versions before 3.75.0 Vulnerable ·payloadcms

Remediation

Fix · CNA payload (payloadcms) Fixed in 3.75.0
Fix · GHSA-hhfx-5x8j-f5f6 payload (npm) Fixed in 3.75.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-27567
2026-10-03 Alias added: GHSA-hhfx-5x8j-f5f6

References

Patch 1

https://github.com/payloadcms/payload/commit/1041bb6

Advisory 2

Other 2

TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
TI-2026-68612 Payload authentication token field handling issue CVSS 4.0CRITICAL 9.2
TI-2026-26995 Payload has Unvalidated Input in Password Recovery Endpoints CVSS 3.1CRITICAL 9.1
TI-2026-68489 Field access control bypass in Payload duplicate operation CVSS 4.0CRITICAL 9.3

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences