{"id":"EUVD-2026-93514","enisaUuid":"998144df-739d-3a70-889f-844e9adccc41","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:51:34 PM","dateUpdated":"Oct 9, 2026, 1:17:45 AM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-9qpg-3cf8-w33x\nhttps://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105868\nGHSA-9qpg-3cf8-w33x\n","assigner":"GitHub_M","epss":0.17,"enisaIdProduct":[{"id":"1cddf656-7626-3af9-8ebf-ace484f54029","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"1e174809-ecb3-30d8-9b09-1b80e31c5e64","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"enisaIdVendor":[{"id":"35be642b-8ec6-3ad2-b315-30d5827a6c5f","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"59c51883-a3f5-30f5-8746-43bd0c8b9ae0","vulnerability":{"id":"GHSA-9qpg-3cf8-w33x","description":"Payload: Uploaded XML files could execute same-origin JavaScript","datePublished":"Oct 7, 2026, 8:28:53 PM","dateUpdated":"Oct 7, 2026, 8:28:53 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-9qpg-3cf8-w33x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105868\nhttps://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93514\n","aliases":"GHSA-9qpg-3cf8-w33x\nCVE-2026-105868\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9d6bde85-c878-3066-b746-02636de0b563","vulnerability":{"id":"CVE-2026-105868","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:51:34 PM","dateUpdated":"Oct 9, 2026, 1:17:45 AM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-9qpg-3cf8-w33x\nhttps://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93514\n","assigner":"GitHub_M","epss":0.17,"dataProcessed":"Nov 4, 2026, 7:15:38 AM","vulnerabilityProduct":[{"id":"84a5782d-9e03-3849-93e8-bdd336691145","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"a6942fb2-053c-3e79-ad93-704661ab8765","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"c5b31f62-f576-31f0-9b75-92f58c2004ed","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}