Read the docs
TI-2026-68617 Aliases CVE-2026-105868GHSA-9qpg-3cf8-w33x

Uploaded XML files can run JavaScript in Payload CMS

Priority MEDIUM 44CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Payload versions before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 are affected. Local upload configurations that accept XML files do not restrict dangerous file types (CWE-434), so an uploaded XML file can store a stylesheet that runs JavaScript in the Payload origin. An attacker with low privileges can upload such a file, and it executes when a logged-in user opens it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.90.0, 4.0.0-canary.34payload (npm): 3.90.0, 4.0.0-canary.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayloadbefore 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.343.90.0, 4.0.0-canary.34Patch availableCNA
—payload (npm)before 3.90.03.90.0Patch availableGHSA-9qpg-3cf8-w33x
—payload (npm)4.0.0-canary.0 to before 4.0.0-canary.344.0.0-canary.34Patch availableGHSA-9qpg-3cf8-w33x
  • payload Vendorpayloadcms Affected before 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 3.90.0, 4.0.0-canary.34 Patch available CNA
  • payload (npm) Vendor— Affected before 3.90.0 Fixed in 3.90.0 Patch available GHSA-9qpg-3cf8-w33x
  • payload (npm) Vendor— Affected 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 4.0.0-canary.34 Patch available GHSA-9qpg-3cf8-w33x

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*before 3.90.0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*4.0.0 canary0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*4.0.0 canary1Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*4.0.0 canary10Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*4.0.0 canary11Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*4.0.0 canary12Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*4.0.0 canary13Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*4.0.0 canary14Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*4.0.0 canary15Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*4.0.0 canary16Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* Versions before 3.90.0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* Versions 4.0.0 canary0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* Versions 4.0.0 canary1 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* Versions 4.0.0 canary10 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* Versions 4.0.0 canary11 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* Versions 4.0.0 canary12 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* Versions 4.0.0 canary13 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* Versions 4.0.0 canary14 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* Versions 4.0.0 canary15 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* Versions 4.0.0 canary16 Vulnerable ·payloadcms
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*4.0.0 canary17Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*4.0.0 canary18Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*4.0.0 canary19Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*4.0.0 canary2Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*4.0.0 canary20Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*4.0.0 canary21Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*4.0.0 canary22Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*4.0.0 canary23Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*4.0.0 canary24Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*4.0.0 canary25Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*4.0.0 canary26Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*4.0.0 canary27Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*4.0.0 canary28Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*4.0.0 canary29Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*4.0.0 canary3Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*4.0.0 canary30Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*4.0.0 canary31Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*4.0.0 canary32Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*4.0.0 canary33Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*4.0.0 canary4Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*4.0.0 canary5Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*4.0.0 canary6Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*4.0.0 canary7Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*4.0.0 canary8Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*4.0.0 canary9Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* Versions 4.0.0 canary17 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* Versions 4.0.0 canary18 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* Versions 4.0.0 canary19 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* Versions 4.0.0 canary2 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* Versions 4.0.0 canary20 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* Versions 4.0.0 canary21 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* Versions 4.0.0 canary22 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* Versions 4.0.0 canary23 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* Versions 4.0.0 canary24 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* Versions 4.0.0 canary25 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* Versions 4.0.0 canary26 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* Versions 4.0.0 canary27 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* Versions 4.0.0 canary28 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* Versions 4.0.0 canary29 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* Versions 4.0.0 canary3 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* Versions 4.0.0 canary30 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* Versions 4.0.0 canary31 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* Versions 4.0.0 canary32 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* Versions 4.0.0 canary33 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* Versions 4.0.0 canary4 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* Versions 4.0.0 canary5 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* Versions 4.0.0 canary6 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* Versions 4.0.0 canary7 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* Versions 4.0.0 canary8 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* Versions 4.0.0 canary9 Vulnerable ·payloadcms

Remediation

Upgrade Payload to version 3.90.0 or 4.0.0-canary.34.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA payload (payloadcms) Fixed in 3.90.0, 4.0.0-canary.34
  • Fix · GHSA-9qpg-3cf8-w33x payload (npm) Fixed in 3.90.0 Advisory →
  • Fix · GHSA-9qpg-3cf8-w33x payload (npm) Fixed in 4.0.0-canary.34 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105868
  2. 2026-10-07 Alias added: GHSA-9qpg-3cf8-w33x
  3. 2026-10-07 Fix available: npm/[email protected], npm/[email protected] · GHSA-9qpg-3cf8-w33x
  4. 2026-10-07 CVSS score added · GHSA-9qpg-3cf8-w33x
  5. 2026-10-07 Weakness changed · GHSA-9qpg-3cf8-w33x
  6. 2026-10-07 5 new references · GHSA-9qpg-3cf8-w33x
  7. 2026-10-07 Priority changed: MEDIUM → LOW
  8. 2026-10-09 CISA SSVC decision points changed
  9. 2026-10-09 Priority changed: LOW → MEDIUM
  10. 2026-10-15 CVSS score added · NVD

References

Patch 2

Advisory 2

Other 1

  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-68612 Payload authentication token field handling issue CVSS 4.0CRITICAL 9.2
  • TI-2026-26995 Payload has Unvalidated Input in Password Recovery Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-68489 Field access control bypass in Payload duplicate operation CVSS 4.0CRITICAL 9.3
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences