{"id":"EUVD-2026-93471","enisaUuid":"d8f0d5c7-ad6d-3c06-a7af-75ae6c9df94b","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.","datePublished":"Oct 6, 2026, 3:58:51 PM","dateUpdated":"Oct 6, 2026, 5:27:31 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-v49j-62m6-pgrr\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","aliases":"CVE-2026-105845\nGHSA-v49j-62m6-pgrr\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"b239d7b8-70e0-3fdd-a3bf-6790b0cea2d5","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.88.0"},{"id":"d64498d0-7531-325d-b8ce-bb903b7e8fc7","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"}],"enisaIdVendor":[{"id":"1f801da2-28d9-3d7c-949e-0aa71bec29d1","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"5d6a099d-0995-3fe1-ad24-60fd74d898ec","vulnerability":{"id":"CVE-2026-105845","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.","datePublished":"Oct 6, 2026, 3:58:51 PM","dateUpdated":"Oct 6, 2026, 5:27:31 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-v49j-62m6-pgrr\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","enisa_id":"EUVD-2026-93471\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 8, 2026, 7:16:13 AM","vulnerabilityProduct":[{"id":"8d38a05e-7743-3a21-90bc-2edde2c8e5ef","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.88.0"},{"id":"cc17ee52-8088-32e9-9034-caeb9c00b02a","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"}],"vulnerabilityVendor":[{"id":"1cf079a7-d908-3d78-be3e-70c636c7657b","vendor":{"name":"payloadcms"}}]}},{"id":"9c06f1fc-d47b-3990-80b0-01b626d35251","vulnerability":{"id":"GHSA-v49j-62m6-pgrr","description":"Payload: SQL Injection in SQLite and Postgres","datePublished":"Oct 6, 2026, 4:09:17 PM","dateUpdated":"Oct 6, 2026, 4:09:18 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-v49j-62m6-pgrr\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","enisa_id":"EUVD-2026-93471\n","aliases":"GHSA-v49j-62m6-pgrr\nCVE-2026-105845\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}