CVE-2026-105867: Payload: Client uploads could overwrite S3 objects

Q: Which deployments are exposed to this issue?

Deployments using @payloadcms/storage-s3 before 3.90.0, or canary releases before 4.0.0-canary.34, are affected only when client uploads are enabled for multiple upload collections that share an S3 bucket and useCompositePrefixes is false or unset.

Q: What level of access does an attacker need?

An attacker must be an authenticated user. No user interaction is required, and the attacker can overwrite an existing object associated with another upload collection.

Q: What is the impact of a successful overwrite?

The overwrite bypasses the target collection's access controls and its prior file validation. This can compromise the integrity of stored uploaded content and has a limited availability impact.

Q: How can this be remediated?

Upgrade to @payloadcms/storage-s3 version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary line. If upgrading is not immediately possible, avoid the affected configuration by not enabling client uploads across multiple collections sharing a bucket while useCompositePrefixes is false or unset.

Published Oct 6, 2026

Updated

Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Affected Software

1 affected component

npm/@payloadcms/storage-s3<3.90.0, <4.0.0-canary.34

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @payloadcms/storage-s3 to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade @payloadcms/storage-s3 to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34

Event History

Oct 6, 2026

CVE Published

via MITRE·04:49 PM

Data Sourced

via MITRE·04:49 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using @payloadcms/storage-s3 before 3.90.0, or canary releases before 4.0.0-canary.34, are affected only when client uploads are enabled for multiple upload collections that share an S3 bucket and useCompositePrefixes is false or unset.

What level of access does an attacker need?

An attacker must be an authenticated user. No user interaction is required, and the attacker can overwrite an existing object associated with another upload collection.

What is the impact of a successful overwrite?

The overwrite bypasses the target collection's access controls and its prior file validation. This can compromise the integrity of stored uploaded content and has a limited availability impact.

How can this be remediated?

Upgrade to @payloadcms/storage-s3 version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary line. If upgrading is not immediately possible, avoid the affected configuration by not enabling client uploads across multiple collections sharing a bucket while useCompositePrefixes is false or unset.

CVE-2026-105867: Payload: Client uploads could overwrite S3 objects

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What level of access does an attacker need?

What is the impact of a successful overwrite?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What level of access does an attacker need?

What is the impact of a successful overwrite?

How can this be remediated?