{"id":"EUVD-2026-93470","enisaUuid":"a1f70054-2e8c-3b65-8a59-eaaef88fc554","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.","datePublished":"Oct 6, 2026, 3:57:05 PM","dateUpdated":"Oct 9, 2026, 1:08:17 AM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","aliases":"CVE-2026-105844\nGHSA-qf28-8hc6-vwrp\n","assigner":"GitHub_M","epss":0.71,"enisaIdProduct":[{"id":"24820efa-d637-3ab0-ab9e-1d18f7028409","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"},{"id":"37dd3e21-2e5f-3931-a6f4-2fbce52eeb70","product":{"name":"plugin-import-export","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0, \u003c 3.88.0"},{"id":"73a5c6a0-7a6e-3b15-8611-9370a3132f63","product":{"name":"plugin-import-export","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"},{"id":"fc6942cb-92c6-31b4-9ac2-380ce9d62f4d","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.88.0"}],"enisaIdVendor":[{"id":"bd8f44db-97a7-36e1-9bb6-27b8f374d0a9","vendor":{"name":"@payloadcms"}},{"id":"df574913-ab67-332a-a6d2-e32b58b56693","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"86883ba6-1956-36bf-ad6c-e90090cfacc1","vulnerability":{"id":"GHSA-qf28-8hc6-vwrp","description":"Payload: Prototype pollution in Payload Import Export plugin","datePublished":"Oct 6, 2026, 4:09:23 PM","dateUpdated":"Oct 6, 2026, 4:09:23 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","enisa_id":"EUVD-2026-93470\n","aliases":"GHSA-qf28-8hc6-vwrp\nCVE-2026-105844\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c413138c-ee0e-3778-966f-11ee7aeb3e8b","vulnerability":{"id":"CVE-2026-105844","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.","datePublished":"Oct 6, 2026, 3:57:05 PM","dateUpdated":"Oct 9, 2026, 1:08:17 AM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","enisa_id":"EUVD-2026-93470\n","assigner":"GitHub_M","epss":0.71,"dataProcessed":"Nov 6, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"1d18097c-d792-363c-8807-c6412bd9289e","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"},{"id":"26edd04d-b920-32b4-bfd5-39ddee765b22","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.88.0"},{"id":"43f4e0e8-2435-34a1-b46c-a595d15952df","product":{"name":"plugin-import-export","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"},{"id":"a16bdfb0-3cdd-3dae-b675-019bb5d55519","product":{"name":"plugin-import-export","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0, \u003c 3.88.0"}],"vulnerabilityVendor":[{"id":"3f01d76b-73ab-3544-a201-803d9b929f22","vendor":{"name":"@payloadcms"}},{"id":"d0a3bab3-84a4-3c9d-a4f2-75393ba213da","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}