CVE-2026-105861 in Payload
Summary
by MITRE • 10/06/2026
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
Payload CMS versions prior to 3.90.0 contain a critical security vulnerability related to the handling of authenticated external URL-based upload retrieval operations. The system allows users with valid authentication credentials to initiate requests that retrieve content from external sources, such as images or documents hosted on third-party servers. During this process, if the target server responds with an HTTP redirect status code pointing to a different location, Payload CMS fails to adequately verify whether the final destination is within a trusted domain list. This lack of validation creates a scenario where sensitive authentication data can be inadvertently forwarded to untrusted external entities.
The technical flaw stems from how the application manages redirects during file retrieval operations. When an authenticated user requests content via an external URL, the underlying HTTP client follows redirections automatically without performing strict origin checks on intermediate or final redirect targets. As a result, if an attacker controls or influences the initial external URL and its subsequent redirect behavior, they can manipulate the request to send headers containing session tokens, cookies, or other authentication credentials to a malicious server under their control. This mechanism effectively bypasses standard security boundaries because the application treats all redirects as legitimate parts of the retrieval process rather than potential vectors for credential leakage.
The operational impact of this vulnerability is significant, particularly in environments where Payload CMS is used to manage sensitive content and user data. An attacker who can trick an authenticated administrator or regular user into initiating a malicious upload request could capture valid session tokens. These captured credentials allow the attacker to impersonate the victim within the application, potentially leading to unauthorized access to private documents, modification of site configurations, or further exploitation through other vulnerabilities that require authentication. This type of attack aligns with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where server-side applications fetch resources from user-supplied URLs without proper validation of the resulting data origin.
From a threat modeling perspective, this vulnerability facilitates credential harvesting and session hijacking attacks that are consistent with ATT&CK technique T1539, specifically Steal Web Session Cookie. By leveraging trusted application behavior to exfiltrate authentication artifacts, attackers can maintain persistent access or escalate privileges without needing to exploit additional software bugs. The risk is exacerbated in multi-tenant deployments or when the CMS handles data for multiple organizations, as compromised sessions could provide broader access than intended by the system's permission model.
To mitigate this vulnerability, administrators must upgrade Payload CMS to version 3.90.0 or later, where the issue has been resolved through improved validation of redirect destinations. Until upgrading is possible, it is advisable to restrict outbound network connections from the server hosting Payload CMS using firewall rules that limit access only to known and trusted external domains involved in legitimate content retrieval operations. Additionally, implementing strict Content Security Policy headers can help reduce the impact if any residual exposure occurs by limiting where browser-based sessions or embedded contexts are allowed to transmit data. Regular security audits of third-party integrations and careful review of user-supplied URLs used in automated processes will further strengthen the defense posture against similar redirect-based attacks.