CVE-2026-105856: Payload: SQL injection in SQLite/Postgres

October 7, 2026

An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload’s SQLite and Postgres.

References

github.com/advisories/GHSA-pj7x-6wpf-pgvp
github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp
nvd.nist.gov/vuln/detail/CVE-2026-105856

Code Behaviors & Features

Detect and mitigate CVE-2026-105856 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →