Read the docs
TI-2026-68480 Aliases CVE-2026-105845GHSA-v49j-62m6-pgrr

SQL injection in Payload SQLite and Postgres adapters

Priority MEDIUM 49CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Payload, a free and open source headless content management system, is affected in versions from 3.0.0 before 3.88.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.27. An untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection (CWE-89) in the SQLite and Postgres adapters.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00381 32nd percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.88.0, 4.0.0-canary.27payload (npm): 3.88.0, 4.0.0-canary.27

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayload3.0.0 to before 3.88.0; 4.0.0-canary.0 to before 4.0.0-canary.273.88.0, 4.0.0-canary.27Patch availableCNA
—payload (npm)3.0.0 to before 3.88.03.88.0Patch availableGHSA-v49j-62m6-pgrr
—payload (npm)4.0.0-canary.0 to before 4.0.0-canary.274.0.0-canary.27Patch availableGHSA-v49j-62m6-pgrr
  • payload Vendorpayloadcms Affected 3.0.0 to before 3.88.0; 4.0.0-canary.0 to before 4.0.0-canary.27 Fixed in 3.88.0, 4.0.0-canary.27 Patch available CNA
  • payload (npm) Vendor— Affected 3.0.0 to before 3.88.0 Fixed in 3.88.0 Patch available GHSA-v49j-62m6-pgrr
  • payload (npm) Vendor— Affected 4.0.0-canary.0 to before 4.0.0-canary.27 Fixed in 4.0.0-canary.27 Patch available GHSA-v49j-62m6-pgrr

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:*——payloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:* Versions — — ·payloadcms

Remediation

Upgrade the npm package payload to version 3.88.0 for the 3.x line and to version 4.0.0-canary.27 for the canary line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA payload (payloadcms) Fixed in 3.88.0, 4.0.0-canary.27
  • Fix · GHSA-v49j-62m6-pgrr payload (npm) Fixed in 3.88.0 Advisory →
  • Fix · GHSA-v49j-62m6-pgrr payload (npm) Fixed in 4.0.0-canary.27 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105845
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Alias added: GHSA-v49j-62m6-pgrr
  4. 2026-10-06 Fix available: npm/[email protected], npm/[email protected] · GHSA-v49j-62m6-pgrr
  5. 2026-10-06 CVSS score added · GHSA-v49j-62m6-pgrr
  6. 2026-10-06 Weakness changed · GHSA-v49j-62m6-pgrr
  7. 2026-10-06 4 new references · GHSA-v49j-62m6-pgrr

References

Other 4

  • TI-2026-10166 PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access CVSS 4.0MEDIUM 5.3
  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-68479 Prototype pollution in Payload Import Export plugin CVSS 4.0CRITICAL 9.3
  • TI-2026-68612 Payload authentication token field handling issue CVSS 4.0CRITICAL 9.2
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences