Vulnerability · Published Apr 1, 2026 · Assigned by GitHub_M
CVE-2026-34750Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Medium 6.5
In plain English
A medium-severity path traversal in payload from payloadcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @payloadcms/storage-azure | 3.78.0 | GHSA-frq9-7j6g-v74x |
| npm | @payloadcms/storage-gcs | 3.78.0 | GHSA-frq9-7j6g-v74x |
| npm | @payloadcms/storage-r2 | 3.78.0 | GHSA-frq9-7j6g-v74x |
| npm | @payloadcms/storage-s3 | 3.78.0 | GHSA-frq9-7j6g-v74x |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| payloadcms | payload | < 3.78.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/payloadcms/payload/security/advisories/GHSA-frq9-7j6g-v74x x_refsource_CONFIRM