{"id":"EUVD-2026-93500","enisaUuid":"a36a88ae-4dc3-37e4-a878-062ed1ec5ce3","description":"Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.","datePublished":"Oct 6, 2026, 4:23:58 PM","dateUpdated":"Oct 6, 2026, 5:39:22 PM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp\nhttps://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105856\nGHSA-pj7x-6wpf-pgvp\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"3ff14e28-6b2b-3bf5-955d-5114489fbeec","product":{"name":"db-vercel-postgres","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0 \u003c 3.73.0"},{"id":"4247a7b2-894b-3521-9888-394d38be62ae","product":{"name":"db-sqlite","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"73347419-4246-3c11-923d-25675bd593b6","product":{"name":"db-d1-sqlite","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"9396d277-335d-3668-b8b9-5eee35f842d5","product":{"name":"db-postgres","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0 \u003c 3.73.0"},{"id":"98dba6eb-6bb4-308d-9d4f-b196f86f7a4c","product":{"name":"db-d1-sqlite","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"b04cfbf0-09b0-3bf2-8e39-93a56557bfd1","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"d6b5b056-b55e-3a42-9d41-b5cfdc33782f","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"f4576a42-265a-34ec-9bca-02684dc23031","product":{"name":"db-sqlite","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"}],"enisaIdVendor":[{"id":"819cc32b-927f-389b-95d0-85a5e2f83d14","vendor":{"name":"payloadcms"}},{"id":"870829ac-c2a3-3099-a2c1-e4b2e3b5fca6","vendor":{"name":"@payloadcms"}}],"enisaIdVulnerability":[{"id":"51a7ed9b-67ea-3bd7-a45d-5e8cb366d647","vulnerability":{"id":"GHSA-pj7x-6wpf-pgvp","description":"Payload: SQL injection in SQLite/Postgres","datePublished":"Oct 7, 2026, 8:30:04 PM","dateUpdated":"Oct 7, 2026, 8:30:04 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105856\nhttps://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93500\n","aliases":"CVE-2026-105856\nGHSA-pj7x-6wpf-pgvp\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ccd526da-7166-3ccf-a5b2-defc86e5adc6","vulnerability":{"id":"CVE-2026-105856","description":"Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.","datePublished":"Oct 6, 2026, 4:23:58 PM","dateUpdated":"Oct 6, 2026, 5:39:22 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp\nhttps://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93500\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Nov 8, 2026, 7:16:13 AM","vulnerabilityProduct":[{"id":"03e2d7ab-7a98-3473-90f2-743841223241","product":{"name":"db-sqlite","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"116816aa-73e8-3033-b702-a2d5085ea441","product":{"name":"db-postgres","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0 \u003c 3.73.0"},{"id":"16014bc6-28a0-3bdf-bdac-13049bc48e9f","product":{"name":"db-d1-sqlite","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"21585c6b-9f82-3630-9d4c-9a586da21864","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"32ba9fc3-381b-3c70-ac68-36d2ad8dfee2","product":{"name":"db-sqlite","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"57813645-a8a8-39f5-ab93-2000082f7d70","product":{"name":"db-d1-sqlite","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"bb32f1c2-67d9-364b-a462-9907c795281f","product":{"name":"db-vercel-postgres","vendor":{"name":"@payloadcms"}},"product_version":"3.0.0 \u003c 3.73.0"},{"id":"cce125ec-9053-34c6-9023-f2b7e9ce77f1","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"a7e35c66-4268-3007-882c-b950c79d5957","vendor":{"name":"payloadcms"}},{"id":"bb63c681-f745-3555-b7e2-82b2e1893a14","vendor":{"name":"@payloadcms"}}]}}],"enisaIdAdvisory":[]}