CVE-2026-105857
Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVSS 3.1
- 10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-94, CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- payloadcms:payload
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r488-j9vj-wx3q | npm | @payloadcms/plugin-form-builder | <3.90.0 | 3.90.0 |
| GHSA-r488-j9vj-wx3q | npm | @payloadcms/plugin-form-builder | >=4.0.0-canary.0 <4.0.0-canary.34 | 4.0.0-canary.34 |