---
id: "CVE-2026-105861"
kind: "vulnerability"
aliases: ["CVE-2026-105861", "GHSA-pj5h-5q6c-3pfx"]
title: "Payload external upload trust validation issue"
severity: "high"
cvss: 8.2
epss: 0.0013500000350177288
exploited: false
status: "open"
category: "package"
products: [{"name": "payload", "fixed": ["3.90.0"], "affected": ">= 3.0.0, < 3.90.0", "ecosystem": "npm"}, {"name": "payload", "fixed": ["4.0.0-canary.34"], "affected": ">= 4.0.0-canary.0, < 4.0.0-canary.34", "ecosystem": "npm"}, {"name": "payloadcms payload", "fixed": ["3.90.0"], "affected": ">= 3.0.0, < 3.90.0", "ecosystem": "vendor"}, {"name": "payloadcms payload", "fixed": [], "affected": "= 4.0.0", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cms", "cwe-200", "cwe-346", "node", "package", "payload", "self-hosted"]
not_affected_if: ["default-config", "no-external-upload-urls"]
published_at: "2026-10-06T17:17:22+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-pj5h-5q6c-3pfx", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105861", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Payload external upload trust validation issue

Payload CMS sends authentication data to unverified destinations when external URL-based upload retrieval is enabled. An attacker who can get an authenticated request to trigger an upload fetch can receive the victim's valid session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:payload affected >= 3.0.0, < 3.90.0 fixed 3.90.0
- npm:payload affected >= 4.0.0-canary.0, < 4.0.0-canary.34 fixed 4.0.0-canary.34
- vendor:payloadcms payload affected >= 3.0.0, < 3.90.0 fixed 3.90.0
- vendor:payloadcms payload affected = 4.0.0 fixed ?

## How to check

Check whether upload external URL retrieval is enabled in the Payload upload config (fetch from external URLs).
Run: npm ls payload to see the installed version; affected if 3.x < 3.90.0 or 4.0.0-canary.x < 4.0.0-canary.34.

## Fix

Upgrade payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
If you cannot upgrade, disable external URL-based upload retrieval or configure the upload header filter to strip auth headers from outbound file requests.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-pj5h-5q6c-3pfx
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105861

## From the sources

## Impact

Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.

**You are affected if:**

- You have enabled external URL-based upload retrieval, where authenticated requests can trigger it.

## Patches

Payload now validates the destination before forwarding authentication data and reapplies that validation when a request changes destination.

Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

## Workarounds
It is recommended to update all Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

If you cannot, a valid workaround exists:
- Disable external URL-based upload retrieval where practical.
- If you cannot disable it, configure the upload header filter to remove authentication data from outbound file requests.
- Restrict access to the affected upload functionality.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_