ZeroDay Findings
Sign inSign up

Findings

CVE-2026-105856

Payload: SQL injection in SQLite/Postgres

Published Oct 6, 2026 · updated Oct 15, 2026 · payloadcms payload

Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 7, 2026 · Catalog

    Detected

    ### Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. #### You are affected if: - You use or . - You use or . - A readable collection has a field, or a field with . - The attacker has read plus create or update access on it. #### You ar

  2. Oct 14, 2026 · Catalog

    Fix available

    npm @payloadcms/db-sqlite 3.0.0 → 3.90.0

  3. Oct 14, 2026 · Catalog

    Fix available

    npm @payloadcms/db-d1-sqlite 3.0.0 → 3.90.0

  4. Oct 14, 2026 · Catalog

    Fix available

    npm @payloadcms/db-postgres 3.0.0 → 3.73.0

  5. Oct 14, 2026 · Catalog

    Fix available

    npm @payloadcms/db-vercel-postgres 3.0.0 → 3.73.0

  6. Oct 14, 2026 · Catalog

    Fix available

    npm @payloadcms/db-sqlite 4.0.0-canary.0 → 4.0.0-canary.34

  7. Oct 14, 2026 · Catalog

    Fix available

    npm @payloadcms/db-d1-sqlite 4.0.0-canary.0 → 4.0.0-canary.34

  8. Oct 14, 2026 · Catalog

    Updated

    ### Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. #### You are affected if: - You use or . - You use or . - A readable collection has a field, or a field with . - The attacker has read plus create or update access on it. #### You ar

  9. Oct 15, 2026 · NIST NVD

    Updated

    Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite

Affected

  • cpe payloadcms/payloadversion unspecified
  • cpe payloadcms/payload4.0.0
  • npm @payloadcms/db-d1-sqlite3.0.0 → 3.90.0
  • npm @payloadcms/db-d1-sqlite4.0.0-canary.0 → 4.0.0-canary.34
  • npm @payloadcms/db-postgres3.0.0 → 3.73.0
  • npm @payloadcms/db-sqlite3.0.0 → 3.90.0
  • npm @payloadcms/db-sqlite4.0.0-canary.0 → 4.0.0-canary.34
  • npm @payloadcms/db-vercel-postgres3.0.0 → 3.73.0

Sources

  • CVE.orgCVE-2026-105856

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-105856

    30-day exploitation probability 0.3%

    first.org
  • GitHub Advisory DatabaseGHSA-pj7x-6wpf-pgvp

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDCVE-2026-105856

    Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field

    nvd.nist.gov
  • OSV.devGHSA-pj7x-6wpf-pgvp

    Payload: SQL injection in SQLite/Postgres

    osv.dev

References