CVE-2026-34750

{
  "id": "CVE-2026-34750",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-01T20:16:27.337",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3."
    },
    {
      "lang": "es",
      "value": "Payload es un sistema de gestión de contenido sin interfaz de código abierto y gratuito. Antes de la versión 3.78.0 en @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2 y @payloadcms/storage-s3, los puntos finales de URL firmadas para carga de cliente para S3, GCS, Azure y R2 no saneaban correctamente los nombres de archivo. Un atacante podría crear nombres de archivo para escapar de la ubicación de almacenamiento prevista. Este problema ha sido parcheado en la versión 3.78.0 para @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2 y @payloadcms/storage-s3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "payloadcms",
          "product": "payload",
          "versions": [
            {
              "version": "< 3.78.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-02T15:33:26.614791Z",
          "id": "CVE-2026-34750",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "3.78.0",
              "matchCriteriaId": "225E9788-C205-479C-B3EE-7A57A468929F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-frq9-7j6g-v74x",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}