Read the docs
TI-2026-68479 Aliases CVE-2026-105844GHSA-qf28-8hc6-vwrp

Prototype pollution in Payload Import Export plugin

Priority MEDIUM 49CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Payload from 3.0.0 before 3.88.0 and from 4.0.0-canary.0 before 4.0.0-canary.27 is affected when the @payloadcms/plugin-import-export plugin is enabled. The plugin accepts prototype-sensitive field paths (CWE-1321), which an unauthenticated remote attacker can submit. This causes unintended application behavior that can lead to remote code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0071 53rd percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.88.0, 4.0.0-canary.27plugin-import-export (@payloadcms): 3.88.0, 4.0.0-canary.27+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayload3.0.0 to before 3.88.0; 4.0.0-canary.0 to before 4.0.0-canary.273.88.0, 4.0.0-canary.27Patch availableCNA
payloadcmsplugin-import-export3.0.0 to before 3.88.0; 4.0.0-canary.0 to before 4.0.0-canary.273.88.0, 4.0.0-canary.27Patch availableCNA
—@payloadcms/plugin-import-export (npm)3.0.0 to before 3.88.03.88.0Patch availableGHSA-qf28-8hc6-vwrp
—@payloadcms/plugin-import-export (npm)4.0.0-canary.0 to before 4.0.0-canary.274.0.0-canary.27Patch availableGHSA-qf28-8hc6-vwrp
  • payload Vendorpayloadcms Affected 3.0.0 to before 3.88.0; 4.0.0-canary.0 to before 4.0.0-canary.27 Fixed in 3.88.0, 4.0.0-canary.27 Patch available CNA
  • plugin-import-export Vendorpayloadcms Affected 3.0.0 to before 3.88.0; 4.0.0-canary.0 to before 4.0.0-canary.27 Fixed in 3.88.0, 4.0.0-canary.27 Patch available CNA
  • @payloadcms/plugin-import-export (npm) Vendor— Affected 3.0.0 to before 3.88.0 Fixed in 3.88.0 Patch available GHSA-qf28-8hc6-vwrp
  • @payloadcms/plugin-import-export (npm) Vendor— Affected 4.0.0-canary.0 to before 4.0.0-canary.27 Fixed in 4.0.0-canary.27 Patch available GHSA-qf28-8hc6-vwrp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:*——payloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:* Versions — — ·payloadcms

Remediation

Upgrade Payload to version 3.88.0 or 4.0.0-canary.27. Upgrade @payloadcms/plugin-import-export to version 3.88.0 or 4.0.0-canary.27.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA payload (payloadcms) Fixed in 3.88.0, 4.0.0-canary.27
  • Fix · CNA plugin-import-export (@payloadcms) Fixed in 3.88.0, 4.0.0-canary.27
  • Fix · GHSA-qf28-8hc6-vwrp @payloadcms/plugin-import-export (npm) Fixed in 3.88.0 Advisory →
  • Fix · GHSA-qf28-8hc6-vwrp @payloadcms/plugin-import-export (npm) Fixed in 4.0.0-canary.27 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105844
  2. 2026-10-06 Alias added: GHSA-qf28-8hc6-vwrp
  3. 2026-10-06 Fix available: npm/@payloadcms/[email protected], npm/@payloadcms/[email protected] · GHSA-qf28-8hc6-vwrp
  4. 2026-10-06 CVSS score added · GHSA-qf28-8hc6-vwrp
  5. 2026-10-06 Weakness changed · GHSA-qf28-8hc6-vwrp
  6. 2026-10-06 4 new references · GHSA-qf28-8hc6-vwrp
  7. 2026-10-09 CISA SSVC decision points changed
  8. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 4

  • TI-2026-10166 PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access CVSS 4.0MEDIUM 5.3
  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-68480 SQL injection in Payload SQLite and Postgres adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68612 Payload authentication token field handling issue CVSS 4.0CRITICAL 9.2
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences