CVE-2026-105861: Payload external upload trust validation issue

Q: Which deployments are affected?

Payload versions after 3.0.0 and before 3.90.0 are affected. Version 3.90.0 fixes the issue.

Q: What does an attacker need to exploit this issue?

Exploitation involves an authenticated external URL-based upload retrieval and a redirect to a destination that has not been verified as trusted. The issue can cause authentication data, including a valid session, to be forwarded to that redirected destination.

Q: Who is most exposed?

Deployments that permit authenticated users to retrieve uploads from external URLs are exposed to this behavior. The provided information does not state whether this functionality is enabled by default.

Q: What should be done if patching is not immediately possible?

The provided information identifies the risky condition as external URL-based upload retrieval that follows redirects to destinations not verified as trusted. Until upgrading, restrict or avoid that workflow where operationally possible and review its handling of redirected URLs.

Published Oct 6, 2026

Updated

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.

Affected Software

1 affected component

Payload Payload>3.0.0<3.90.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Payload to a version that resolves this vulnerability.
Fixed in 3.90.0

Event History

Oct 6, 2026

CVE Published

via MITRE·04:34 PM

Data Sourced

via MITRE·04:34 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Payload versions after 3.0.0 and before 3.90.0 are affected. Version 3.90.0 fixes the issue.

What does an attacker need to exploit this issue?

Exploitation involves an authenticated external URL-based upload retrieval and a redirect to a destination that has not been verified as trusted. The issue can cause authentication data, including a valid session, to be forwarded to that redirected destination.

Who is most exposed?

Deployments that permit authenticated users to retrieve uploads from external URLs are exposed to this behavior. The provided information does not state whether this functionality is enabled by default.

What should be done if patching is not immediately possible?

The provided information identifies the risky condition as external URL-based upload retrieval that follows redirects to destinations not verified as trusted. Until upgrading, restrict or avoid that workflow where operationally possible and review its handling of redirected URLs.

CVE-2026-105861: Payload external upload trust validation issue

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Who is most exposed?

What should be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Who is most exposed?

What should be done if patching is not immediately possible?