CVE-2026-34746 in payload
Сводка (Английский)
Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Ответственный
GitHub_M
Резервировать
30.03.2026
Раскрытие
01.04.2026
Статус
Подтверждённый
Записи
VulDB provides additional information and datapoints for this CVE:
| ИД | Уязвимость | CWE | Экс | Кон | CVE |
|---|---|---|---|---|---|
| 354763 | payloadcms payload Upload эскалация привилегий | 918 | Не определено | Официальное исправление | CVE-2026-34746 |