GHSA-7vg8-29qx-jgj8: Npm/@payloadcms/storage-s3 vulnerability

Q: Which deployments are affected?

You are affected only if client uploads are enabled for multiple collections that share an S3 bucket and useCompositePrefixes is unset or configured as false.

Q: What access does an attacker need?

An attacker needs to be an authenticated user. They could overwrite an existing S3 object from another upload collection, bypassing that collection's access controls and prior file validation.

Q: What versions contain the fix?

Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later.

Q: What can be done if an upgrade cannot be applied immediately?

Disable client uploads until the upgrade can be completed.

Published Oct 7, 2026

Updated

Impact An authenticated user could overwrite an existing S3 object belonging to another upload collection, bypassing that collection’s access controls and prior file validation.

You are affected if ALL of these are true: - Client uploads are enabled for multiple collections that share an S3 bucket. - useCompositePrefixes is not configured or is set to false.

Patches Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds Disable client uploads until you can upgrade.

Affected Software

2 affected componentsFixes available

npm/@payloadcms/storage-s3>=4.0.0-canary.0<4.0.0-canary.34

4.0.0-canary.34

npm/@payloadcms/storage-s3<3.90.0

3.90.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@payloadcms/storage-s3 to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Upgrade
Upgrade npm/@payloadcms/storage-s3 to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Configuration
Disable client uploads until upgrading.
Payload client uploads = disabled

Event History

Oct 7, 2026

Advisory Published

via GitHub·08:28 PM

Data Sourced

via GitHub·08:28 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected?

You are affected only if client uploads are enabled for multiple collections that share an S3 bucket and useCompositePrefixes is unset or configured as false.

What access does an attacker need?

An attacker needs to be an authenticated user. They could overwrite an existing S3 object from another upload collection, bypassing that collection's access controls and prior file validation.

What versions contain the fix?

Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later.

What can be done if an upgrade cannot be applied immediately?

Disable client uploads until the upgrade can be completed.

GHSA-7vg8-29qx-jgj8: Npm/@payloadcms/storage-s3 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What versions contain the fix?

What can be done if an upgrade cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What versions contain the fix?

What can be done if an upgrade cannot be applied immediately?