CVE-2026-105868: Payload: Uploaded XML files could execute same-origin JavaScript
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34
Event History
Frequently Asked Questions
Who is exposed to this issue?
Payload CMS deployments using a local upload configuration that accepts XML files are affected if they run a version before 3.90.0 or a canary version before 4.0.0-canary.34. The issue requires a logged-in user to open the uploaded file.
What does an attacker need to exploit it?
An attacker needs to be able to store an XML file and stylesheet through an affected local upload configuration. Exploitation occurs when a logged-in user opens that file, causing JavaScript to execute in the Payload origin.
What should be done if an upgrade cannot happen immediately?
Remove XML from affected local upload configurations to prevent storage of the malicious XML files described. Upgrade to Payload 3.90.0 or 4.0.0-canary.34 when possible.
How can we determine whether our deployment may be affected?
Check whether the Payload version is earlier than 3.90.0, or for canary builds earlier than 4.0.0-canary.34, and review local upload configurations for XML acceptance. Also review stored uploads for XML files accompanied by stylesheets, particularly files that logged-in users may have opened.