CVE-2026-105865
Payload is a free and open source headless content management system.
Published Oct 6, 2026 · updated Oct 15, 2026 · payloadcms payload
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 6, 2026 · NIST NVD
Detected
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to truste
Oct 15, 2026 · NIST NVD
Updated
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to truste
Affected
- cpe payloadcms/payloadversion unspecified
- cpe payloadcms/payload4.0.0
Sources
- CVE.orgVulnerability recordCVE-2026-105865
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-105865
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2026-105865
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configur
nvd.nist.gov