CVE-2026-105844
Critical · CVSS 9.3- CVSS
- 9.3
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-1321
Description
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
Affected packages
| npm | @payloadcms/plugin-import-export | 3.0.0 → 3.88.0 |
| npm | @payloadcms/plugin-import-export | 4.0.0-canary.0 → 4.0.0-canary.27 |
References
Status: profiled · ingested 2026-10-09T06:00:43.000Z