CVE-2026-34746

{
  "id": "CVE-2026-34746",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-01T20:16:26.727",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1."
    },
    {
      "lang": "es",
      "value": "Payload es un sistema de gestión de contenidos sin interfaz, gratuito y de código abierto. Antes de la versión 3.79.1, existe una vulnerabilidad autenticada de falsificación de petición del lado del servidor (SSRF) en la funcionalidad de carga. Los usuarios autenticados con acceso de creación o actualización a una colección con carga habilitada podrían hacer que el servidor realice peticiones HTTP salientes a URL arbitrarias. Este problema ha sido parcheado en la versión 3.79.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "payloadcms",
          "product": "payload",
          "versions": [
            {
              "version": "< 3.79.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-02T15:10:39.687505Z",
          "id": "CVE-2026-34746",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "3.79.1",
              "matchCriteriaId": "B4AE65F8-450D-4573-9CD7-1AA42CE5DC28"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/payloadcms/payload/releases/tag/v3.79.1",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-6r7f-q7f5-wpx8",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}