CVE-2026-105856: Payload: SQL injection in SQLite/Postgres

Q: Which deployments are affected?

Affected deployments use the SQLite or Postgres Payload database packages and have a collection containing a JSON field, or a blocks field with blocksAsJSON enabled. Collections without those fields, and richText fields, are not affected.

Q: What access does an attacker need?

An attacker needs read access plus either create or update access to an affected collection. They can exploit the issue by supplying a crafted field path and operators.

Q: Which versions contain fixes?

For the SQLite packages, fixes are available in versions 3.90.0 and 4.0.0-canary.34. For the Postgres packages, the fix is available in version 3.73.0.

Q: What can be done if an immediate upgrade is not possible?

Limit read, create, and update access to affected collections, particularly for users who do not require those permissions. Collections without JSON fields or blocks fields configured with blocksAsJSON are not affected.

Published Oct 6, 2026

Updated

Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.

Affected Software

2 affected components

npm/@payloadcms/db-sqlite<3.90.0, <4.0.0-canary.34

npm/@payloadcms/db-postgres<3.73.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Payload SQLite packages to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload SQLite packages to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Upgrade
Upgrade Payload Postgres packages to a version that resolves this vulnerability.
Fixed in 3.73.0

Event History

Oct 6, 2026

CVE Published

via MITRE·04:23 PM

Data Sourced

via MITRE·04:23 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected deployments use the SQLite or Postgres Payload database packages and have a collection containing a JSON field, or a blocks field with blocksAsJSON enabled. Collections without those fields, and richText fields, are not affected.

What access does an attacker need?

An attacker needs read access plus either create or update access to an affected collection. They can exploit the issue by supplying a crafted field path and operators.

Which versions contain fixes?

For the SQLite packages, fixes are available in versions 3.90.0 and 4.0.0-canary.34. For the Postgres packages, the fix is available in version 3.73.0.

What can be done if an immediate upgrade is not possible?

Limit read, create, and update access to affected collections, particularly for users who do not require those permissions. Collections without JSON fields or blocks fields configured with blocksAsJSON are not affected.

CVE-2026-105856: Payload: SQL injection in SQLite/Postgres

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

Which versions contain fixes?

What can be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

Which versions contain fixes?

What can be done if an immediate upgrade is not possible?