CVE-2026-105844— Payload: Prototype pollution in Payload Import Export plugin
Quick assessment
Affected
payloadcms payload
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Payload 是一款免费且开源的无头内容管理系统。在 3.0.0 至 3.88.0（不含）版本以及 4.0.0-canary.27（不含）之前的 canary 版本中，当启用了 插件时，未认证的用户可以提交包含原型污染敏感性的字段路径，从而导致意外的应用行为，并可能引发远程代码执行（RCE）漏洞。该问题已在版本 3.88.0 和 4.0.0-canary.27 中得到修复。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105844
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Payload: Prototype pollution in Payload Import Export plugin
Source: CVE Program / CVE List V5
Vulnerability Description
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| payloadcms | payload | >= 3.0.0, < 3.88.0 | - |
|
| @payloadcms | plugin-import-export | >= 3.0.0, < 3.88.0 | - |
|
II. Public POCs for CVE-2026-105844
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105844
请登录查看更多情报信息。
Other References for CVE-2026-105844 (3)
-
https://github.com/payloadcms/payload/releases/tag/v3.88.0 x_refsource_MISC
-
https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp x_refsource_CONFIRM
Same Patch Batch · payloadcms · 2026-10-06 · 13 CVEs total
| CVE-2026-105845 | 9.8 CRITICAL | Payload: SQL Injection in SQLite and Postgres |
| CVE-2026-105851 | 9.3 CRITICAL | Payload: Field access control bypass on auth collections |
| CVE-2026-105850 | 8.8 HIGH | Payload: Order confirmation validation issue in Payload Ecommerce |
| CVE-2026-105806 | 8.6 HIGH | Payload: Improper access control for MCP API keys |
| CVE-2026-105849 | 7.7 HIGH | Payload: API key disclosure through ordinary document reads |
| CVE-2026-105853 | 7.1 HIGH | Payload: Token refresh and password reset responses may expose restricted user fields |
| CVE-2026-105847 | 7.1 HIGH | Payload: Polymorphic join queries could disclose hidden fields |
| CVE-2026-105805 | 6.9 MEDIUM | Payload: Sort queries could expose protected field information |
| CVE-2026-105852 | 6.9 MEDIUM | Payload relationship-query authorization bypass |
| CVE-2026-105848 | 6.4 MEDIUM | Payload: Insufficient Access Control in Stripe REST Proxy |
| CVE-2026-105846 | 6.1 MEDIUM | Payload: Untrusted redirect URL parameter exploit |
| CVE-2026-105804 | 5.7 MEDIUM | Payload: Password hashes use insufficient PBKDF2 iterations |
IV. Related Vulnerabilities
Same product: payload
-
CVE-2026-105853
Payload: Token refresh and password reset responses may expo -
CVE-2026-105852
Payload relationship-query authorization bypass -
CVE-2026-105851
Payload: Field access control bypass on auth collections -
CVE-2026-105850
Payload: Order confirmation validation issue in Payload Ecom -
CVE-2026-105849
Payload: API key disclosure through ordinary document reads
Same vendor: payloadcms
-
CVE-2026-105853
Payload: Token refresh and password reset responses may expo -
CVE-2026-105852
Payload relationship-query authorization bypass -
CVE-2026-105851
Payload: Field access control bypass on auth collections -
CVE-2026-105850
Payload: Order confirmation validation issue in Payload Ecom -
CVE-2026-105849
Payload: API key disclosure through ordinary document reads
Same weakness: CWE-1321
-
CVE-2026-104852
GraphQL Tools has prototype pollution in well-established ut -
CVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads -
CVE-2026-86536
Apache Thrift, Apache Thrift, Apache Thrift: A map key from -
CVE-2026-104183
stream-json: Prototype pollution: Assembler writes this.curr -
CVE-2026-102992
piscina: Prototype-pollution gadget in ThreadPool.options al
V. Comments for CVE-2026-105844
No comments yet