CVE-2026-105857: Payload Form Builder has an RCE issue

October 7, 2026

A vulnerability in @payloadcms/plugin-form-builder in versions < 3.90.0 allow submissions which could be crafted to execute remote code on the server.

You are affected if:

You are using @payloadcms/plugin-form-builder

References

github.com/advisories/GHSA-r488-j9vj-wx3q
github.com/payloadcms/payload/commit/333b82b9f3e685fed6826c2e3270da79df8336c6
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q
nvd.nist.gov/vuln/detail/CVE-2026-105857

Code Behaviors & Features

Detect and mitigate CVE-2026-105857 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →