CVE-2026-105844: Payload: Prototype pollution in Payload Import Export plugin
Impact An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE).
Applications that do not use @payloadcms/plugin-import-export are not affected.
Patches Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.
Workarounds Upgrading is recommended. Until then, disable the Import Export plugin or restrict access to its endpoints.
Other sources
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@payloadcms/plugin-import-exportto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Upgrade
Upgrade
npm/@payloadcms/plugin-import-exportto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Configuration
Disable the Import Export plugin until upgrading.
@payloadcms/plugin-import-export enabled = false - Compensating control
Restrict access to the Import Export plugin endpoints until upgrading.
Event History
Frequently Asked Questions
Which deployments are affected?
Only applications with @payloadcms/plugin-import-export enabled are affected. Applications that do not use this plugin are not affected.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can submit prototype-sensitive field paths, and no user interaction is required.
What versions contain the fix?
Upgrade Payload packages to version 3.88.0 or later, or to 4.0.0-canary.27 or later. Affected releases include versions from 3.0.0 before 3.88.0 and canary releases before 4.0.0-canary.27.
What can be done if an upgrade cannot be applied immediately?
Disable the Import Export plugin or restrict access to its endpoints until the upgrade can be completed.