CVE-2026-105862 in Payload
Summary
by MITRE • 10/06/2026
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
Payload CMS, a popular open-source headless content management system built on Node.js, suffered from a critical input validation flaw affecting its media handling capabilities prior to version 3.90.0 and canary versions before 4.0.0-canary.34. The vulnerability specifically impacts collections configured to allow the upload of Scalable Vector Graphics (SVG) files with download permissions enabled. SVG is an XML-based vector image format that, unlike static raster images such as PNG or JPEG, supports embedded scripting languages including JavaScript. This dynamic capability makes SVG a frequent target for web application attacks when proper sanitization measures are not rigorously enforced during the ingestion process.
The core technical flaw lies in the insufficient sanitization of uploaded SVG files within Payload CMS. When an administrator or authorized user uploads an SVG file to a collection that permits downloads, the system fails to adequately strip dangerous elements from the XML structure. Specifically, the application does not properly validate and sanitize script tags, event handlers such as onload attributes, or other executable code embedded within the graphic data. This oversight allows attackers to craft malicious SVG payloads containing JavaScript code designed for Cross-Site Scripting (XSS) attacks. The vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation known commonly as Cross-site Scripting.
The operational impact of this vulnerability is significant due to the download functionality associated with the affected collections. Unlike vulnerabilities that require direct rendering within a web page context, this flaw exploits the user's action of downloading and subsequently opening the file in an external viewer or browser. When a victim downloads the malicious SVG and opens it, their local environment executes the embedded JavaScript payload. This can lead to various adverse outcomes depending on the execution context and privileges available to the application running the SVG viewer. Attackers may achieve remote code execution if the viewing software has elevated permissions, steal sensitive data stored in browser cookies or local storage if viewed via a web-based previewer before download, or perform actions on behalf of the user such as modifying content within the CMS interface through session hijacking techniques.
This attack vector aligns with several tactics and techniques defined by the MITRE ATT&CK framework for enterprise security. It primarily falls under the Initial Access tactic using Valid Accounts if an attacker compromises a legitimate account to upload the payload, or potentially Supply Chain Compromise if they inject it into trusted content streams. The execution phase corresponds to Technique T1059 Command and Scripting Interpreter, specifically leveraging JavaScript within XML documents. Furthermore, the exfiltration of data via this method relates to Exfiltration Over Alternative Protocol techniques where sensitive information is sent out from the victim's machine through HTTP requests initiated by the malicious script.
To mitigate this vulnerability, organizations using Payload CMS must immediately upgrade to version 3.90.0 or later for stable releases, or version 4.0.0-canary.34 and above for canary builds. These versions include enhanced sanitization routines that properly filter out executable code from SVG inputs before storage. For environments where upgrading is not immediately feasible, administrators should consider disabling the download functionality for collections containing user-uploaded media until a patch can be applied. Additionally, implementing strict Content Security Policy headers in any web-based preview interfaces can help mitigate potential XSS impacts by restricting script execution sources. Regular security audits of file upload handlers and adherence to OWASP guidelines for input validation are recommended best practices to prevent similar issues in future deployments.