{"id":"EUVD-2026-93508","enisaUuid":"368702ed-e433-3cb2-957d-67bdca5c3799","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:37:59 PM","dateUpdated":"Oct 6, 2026, 5:24:09 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-2pwp-2369-8fg3\nhttps://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105862\nGHSA-2pwp-2369-8fg3\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"212983ab-65ef-3be6-870e-59f0119eadc3","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"e5356f92-bbb4-399f-8b38-a123ab23a9e6","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"enisaIdVendor":[{"id":"9e5722ed-f793-3de4-87ce-767f7cf801f3","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"691253ac-cea1-39d6-b0b0-fbeb876e33b9","vulnerability":{"id":"CVE-2026-105862","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:37:59 PM","dateUpdated":"Oct 6, 2026, 5:24:09 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-2pwp-2369-8fg3\nhttps://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93508\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 6, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"2e32c890-7952-3c54-ad42-0fa270e518c5","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"db8a161e-06a8-3e9b-8e7e-9604a8f36b9f","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"d79256b8-6654-31da-b435-84f28871a6eb","vendor":{"name":"payloadcms"}}]}},{"id":"902b86a8-d730-3cd3-9fc1-6ab6c92259b5","vulnerability":{"id":"GHSA-2pwp-2369-8fg3","description":"Payload: Bypassed sanitization of user uploaded SVGs","datePublished":"Oct 7, 2026, 8:29:36 PM","dateUpdated":"Oct 7, 2026, 8:29:36 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-2pwp-2369-8fg3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105862\nhttps://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93508\n","aliases":"GHSA-2pwp-2369-8fg3\nCVE-2026-105862\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}