CVE-2026-105868

UNKNOWN 0.0

Payload: Uploaded XML files could execute same-origin JavaScript

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CWE	CWE-434
Vendor	payloadcms
Product	payload
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for payloadcms payload

Be the first to know when new unknown vulnerabilities affecting payloadcms payload are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

payloadcms / payload

< 3.90.0 >= 4.0.0-canary.0, < 4.0.0-canary.34

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/payloadcms/payload/security/advisories/GHSA-9qpg-3cf8-w33x github.com: https://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf github.com: https://github.com/payloadcms/payload/releases/tag/v3.90.0