GHSA-9qpg-3cf8-w33x: Malicious File Upload

Q: Who is exposed to this issue?

Payload deployments that accept XML uploads are affected. XML uploads are accepted by default, so deployments may be exposed unless they have explicitly disallowed them.

Q: What must an attacker do for exploitation to occur?

An attacker needs to upload a malicious XML file and stylesheet under a vulnerable local upload configuration. A logged-in user must then open the uploaded file for JavaScript to execute in the Payload origin.

Q: What can be done if upgrading is not immediately possible?

Disallow XML and XSL uploads until Payload packages can be upgraded. The available fixes are Payload versions 3.90.0 or later, or 4.0.0-canary.34 or later.

Published Oct 7, 2026

Updated

Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file.

You are affected if: - You accept XML uploads (accepted by default).

Patches Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds Disallow XML/XSL uploads.

Affected Software

2 affected componentsFixes available

npm/payload>=4.0.0-canary.0<4.0.0-canary.34

4.0.0-canary.34

npm/payload<3.90.0

3.90.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/payload to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Upgrade
Upgrade npm/payload to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Configuration
Disallow XML and XSL uploads.
Payload XML/XSL uploads = disallow

Event History

Oct 7, 2026

Advisory Published

via GitHub·08:28 PM

Data Sourced

via GitHub·08:28 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Payload deployments that accept XML uploads are affected. XML uploads are accepted by default, so deployments may be exposed unless they have explicitly disallowed them.

What must an attacker do for exploitation to occur?

An attacker needs to upload a malicious XML file and stylesheet under a vulnerable local upload configuration. A logged-in user must then open the uploaded file for JavaScript to execute in the Payload origin.

What can be done if upgrading is not immediately possible?

Disallow XML and XSL uploads until Payload packages can be upgraded. The available fixes are Payload versions 3.90.0 or later, or 4.0.0-canary.34 or later.

GHSA-9qpg-3cf8-w33x: Malicious File Upload

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do for exploitation to occur?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do for exploitation to occur?

What can be done if upgrading is not immediately possible?