{"id":"GHSA-pj5h-5q6c-3pfx","revision":"398d6ec5d04d4b83a060761e4eceee98","records":[{"revision":"398d6ec5d04d4b83a060761e4eceee98","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-pj5h-5q6c-3pfx","aliases":["CVE-2026-105861"],"title":"Payload external upload trust validation issue","description":"## Impact\n\nUnder certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.\n\n**You are affected if:**\n\n- You have enabled external URL-based upload retrieval, where authenticated requests can trigger it.\n\n## Patches\n\nPayload now validates the destination before forwarding authentication data and reapplies that validation when a request changes destination.\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\n## Workarounds\nIt is recommended to update all Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\nIf you cannot, a valid workaround exists:\n- Disable external URL-based upload retrieval where practical.\n- If you cannot disable it, configure the upload header filter to remove authentication data from outbound file requests.\n- Restrict access to the affected upload functionality.","state":0,"publishedAt":"2026-10-07T20:29:41+00:00","modifiedAt":"2026-10-07T20:45:05.7889752+00:00","affected":[{"ecosystem":"npm","name":"payload","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.90.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"payload","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0-canary.0"},{"kind":"fixed","version":"4.0.0-canary.34"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/payloadcms/payload/security/advisories/GHSA-pj5h-5q6c-3pfx","https://nvd.nist.gov/vuln/detail/CVE-2026-105861","https://github.com/payloadcms/payload/commit/ba5cf6ae20d27a2c15106cb37466419031f86e6d","https://github.com/payloadcms/payload","https://github.com/payloadcms/payload/releases/tag/v3.90.0"],"sourceUrl":"https://github.com/advisories/GHSA-pj5h-5q6c-3pfx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-pj5h-5q6c-3pfx","identifiers":["GHSA-pj5h-5q6c-3pfx","CVE-2026-105861"]},"retained":false,"historicalAffected":[]}],"coverage":[]}