{"id":"EUVD-2026-93501","enisaUuid":"32b1c280-a01a-3d08-93ed-e4bd0efca648","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:26:54 PM","dateUpdated":"Oct 6, 2026, 5:23:32 PM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q\nhttps://github.com/payloadcms/payload/commit/333b82b9f3e685fed6826c2e3270da79df8336c6\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105857\nGHSA-r488-j9vj-wx3q\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"26a3159f-6639-377e-887e-ece1ebd28e51","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"d3b4d817-c63f-3777-9d17-a677974702b4","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"enisaIdVendor":[{"id":"828623ec-97fd-3c5c-8d43-4dd5d51dc665","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"383123e1-b3c6-304f-9017-3275d31ec508","vulnerability":{"id":"CVE-2026-105857","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:26:54 PM","dateUpdated":"Oct 6, 2026, 5:23:32 PM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q\nhttps://github.com/payloadcms/payload/commit/333b82b9f3e685fed6826c2e3270da79df8336c6\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93501\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Nov 6, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"6b70ce23-cee8-3a44-9864-fe74af9a3e8a","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"f9cada0c-bd43-3093-a881-ff6151e2c280","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"vulnerabilityVendor":[{"id":"8745a20e-b42d-32f8-b020-8f8dbcfe4812","vendor":{"name":"payloadcms"}}]}},{"id":"7cf3299e-3a8b-3a27-9838-68f7c7997626","vulnerability":{"id":"GHSA-r488-j9vj-wx3q","description":"Payload Form Builder has an RCE issue","datePublished":"Oct 7, 2026, 8:28:33 PM","dateUpdated":"Oct 7, 2026, 8:28:48 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105857\nhttps://github.com/payloadcms/payload/commit/333b82b9f3e685fed6826c2e3270da79df8336c6\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93501\n","aliases":"GHSA-r488-j9vj-wx3q\nCVE-2026-105857\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}