Read the docs
TI-2026-68614 Aliases CVE-2026-105865GHSA-p223-2wr2-j562

Path traversal in Payload CMS upload cleanup deletes unintended files

Priority LOW 37CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Payload, a headless content management system, is affected before 3.90.0 and in canary versions from 4.0.0-canary.0 before 4.0.0-canary.34. Incomplete validation (CWE-22) lets file cleanup remove files outside the configured upload directory. An authenticated user who can update or delete locally stored uploads over the network can cause data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.90.0, 4.0.0-canary.34payload (npm): 3.90.0, 4.0.0-canary.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayloadbefore 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.343.90.0, 4.0.0-canary.34Patch availableCNA
—payload (npm)before 3.90.03.90.0Patch availableGHSA-p223-2wr2-j562
—payload (npm)4.0.0-canary.0 to before 4.0.0-canary.344.0.0-canary.34Patch availableGHSA-p223-2wr2-j562
  • payload Vendorpayloadcms Affected before 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 3.90.0, 4.0.0-canary.34 Patch available CNA
  • payload (npm) Vendor— Affected before 3.90.0 Fixed in 3.90.0 Patch available GHSA-p223-2wr2-j562
  • payload (npm) Vendor— Affected 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 4.0.0-canary.34 Patch available GHSA-p223-2wr2-j562

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*before 3.90.0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*4.0.0 canary0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*4.0.0 canary1Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*4.0.0 canary10Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*4.0.0 canary11Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*4.0.0 canary12Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*4.0.0 canary13Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*4.0.0 canary14Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*4.0.0 canary15Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*4.0.0 canary16Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* Versions before 3.90.0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* Versions 4.0.0 canary0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* Versions 4.0.0 canary1 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* Versions 4.0.0 canary10 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* Versions 4.0.0 canary11 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* Versions 4.0.0 canary12 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* Versions 4.0.0 canary13 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* Versions 4.0.0 canary14 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* Versions 4.0.0 canary15 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* Versions 4.0.0 canary16 Vulnerable ·payloadcms
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*4.0.0 canary17Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*4.0.0 canary18Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*4.0.0 canary19Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*4.0.0 canary2Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*4.0.0 canary20Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*4.0.0 canary21Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*4.0.0 canary22Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*4.0.0 canary23Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*4.0.0 canary24Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*4.0.0 canary25Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*4.0.0 canary26Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*4.0.0 canary27Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*4.0.0 canary28Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*4.0.0 canary29Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*4.0.0 canary3Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*4.0.0 canary30Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*4.0.0 canary31Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*4.0.0 canary32Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*4.0.0 canary33Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*4.0.0 canary4Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*4.0.0 canary5Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*4.0.0 canary6Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*4.0.0 canary7Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*4.0.0 canary8Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*4.0.0 canary9Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* Versions 4.0.0 canary17 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* Versions 4.0.0 canary18 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* Versions 4.0.0 canary19 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* Versions 4.0.0 canary2 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* Versions 4.0.0 canary20 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* Versions 4.0.0 canary21 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* Versions 4.0.0 canary22 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* Versions 4.0.0 canary23 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* Versions 4.0.0 canary24 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* Versions 4.0.0 canary25 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* Versions 4.0.0 canary26 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* Versions 4.0.0 canary27 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* Versions 4.0.0 canary28 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* Versions 4.0.0 canary29 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* Versions 4.0.0 canary3 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* Versions 4.0.0 canary30 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* Versions 4.0.0 canary31 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* Versions 4.0.0 canary32 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* Versions 4.0.0 canary33 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* Versions 4.0.0 canary4 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* Versions 4.0.0 canary5 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* Versions 4.0.0 canary6 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* Versions 4.0.0 canary7 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* Versions 4.0.0 canary8 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* Versions 4.0.0 canary9 Vulnerable ·payloadcms

Remediation

Upgrade the npm package payload to 3.90.0 or, on the canary line, to 4.0.0-canary.34.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA payload (payloadcms) Fixed in 3.90.0, 4.0.0-canary.34
  • Fix · GHSA-p223-2wr2-j562 payload (npm) Fixed in 3.90.0 Advisory →
  • Fix · GHSA-p223-2wr2-j562 payload (npm) Fixed in 4.0.0-canary.34 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105865
  2. 2026-10-07 Alias added: GHSA-p223-2wr2-j562
  3. 2026-10-07 Fix available: npm/[email protected], npm/[email protected] · GHSA-p223-2wr2-j562
  4. 2026-10-07 CVSS score added · GHSA-p223-2wr2-j562
  5. 2026-10-07 Weakness changed · GHSA-p223-2wr2-j562
  6. 2026-10-07 5 new references · GHSA-p223-2wr2-j562

References

Patch 2

Advisory 2

Other 1

  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-68612 Payload authentication token field handling issue CVSS 4.0CRITICAL 9.2
  • TI-2026-26995 Payload has Unvalidated Input in Password Recovery Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-68489 Field access control bypass in Payload duplicate operation CVSS 4.0CRITICAL 9.3
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences