{"id":"EUVD-2026-18011","enisaUuid":"a03aa8b0-c95b-39ac-af7a-8620bd987697","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.","datePublished":"Apr 1, 2026, 7:43:16 PM","dateUpdated":"Apr 2, 2026, 3:12:09 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-6r7f-q7f5-wpx8\nhttps://github.com/payloadcms/payload/releases/tag/v3.79.1\n","aliases":"CVE-2026-34746\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"d1ce8649-fafb-310e-b717-b36954436e4c","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.79.1"}],"enisaIdVendor":[{"id":"cd57c1fa-e39e-3019-b34b-ca09f1aa661c","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"64da04fc-17e5-3f42-bb91-f340584b8d08","vulnerability":{"id":"GHSA-6r7f-q7f5-wpx8","description":"Payload has Authenticated SSRF via Upload Functionality","datePublished":"Apr 1, 2026, 9:25:33 PM","dateUpdated":"Apr 6, 2026, 4:47:04 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-6r7f-q7f5-wpx8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34746\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.79.1\n","enisa_id":"EUVD-2026-18011\n","aliases":"GHSA-6r7f-q7f5-wpx8\nCVE-2026-34746\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c17d3120-b75e-3944-a8db-5075b286014c","vulnerability":{"id":"CVE-2026-34746","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.","datePublished":"Apr 1, 2026, 7:43:16 PM","dateUpdated":"Apr 2, 2026, 3:12:09 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-6r7f-q7f5-wpx8\nhttps://github.com/payloadcms/payload/releases/tag/v3.79.1\n","enisa_id":"EUVD-2026-18011\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 1, 2026, 7:19:41 AM","vulnerabilityProduct":[{"id":"2bfb0730-5bab-3f0c-b81a-c66d3ff1cc7f","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.79.1"}],"vulnerabilityVendor":[{"id":"ac8c837f-c2bb-352d-b650-b2b4650edbca","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}