Payload CMS v3.90.0 Security Fixes: Password Reset, File Upload Validation, and API Key Hardening

Vulnerability Overview This version (v3.90.0) includes a series of critical security fixes, and an upgrade is recommended as soon as possible. The updates primarily address security issues related to password resets, file uploads, external file retrieval, form submissions, polymorphic relationships, and API keys. Scope of Impact Password Reset: A new field has been introduced, affecting projects that utilize the password reset functionality. File Uploads: Stricter validation is now applied to SVG and XML uploads, impacting users who employ these file types. External File Retrieval: Trusted sources are now required, affecting projects that use non-HTTPS URLs for external files. Form Submissions: Default read access permissions for form submissions are restricted to the admin collection, impacting projects with multiple authentication collections. Polymorphic Relationships: Stricter clause validation is enforced, affecting projects that use polymorphic relationships. API Keys: API keys can no longer be read after generation, affecting projects that generate API keys via the UI or Payload operations. Remediation Steps Password Reset: - Regenerate types: - If using a relational database, execute the migration: File Uploads: - Review affected upload and XML delivery workflows. - Ensure that custom upload clients send the required metadata and return headers. - Set in the collection's property if the previous behavior explicitly required it. External File Retrieval: - Configure or add the exact application origin to CORS or CSRF configuration. - Replace non-HTTPS external file URLs with HTTPS URLs. - Review and retain access restrictions as needed. Form Submissions: - Provide explicit or to override the new defaults. Polymorphic Relationships: - Review constraints and read access rules for each referenced collection. - If using folders, review the read access rules for enabled collections within each folder and the Admin base filters. - Rewrite unsupported filters to use direct, compatible fields and retain access restrictions. API Keys: - If you wish to retain the old behavior, set the following option in your configuration: Proof of Concept (PoC) No PoC code provided.

Goal Reached Thanks to every supporter — we hit 100%!

Payload CMS v3.90.0 Security Fixes: Password Reset, File Upload Validation, and API Key Hardening

More from this source