CVE-2026-105861: Payload external upload trust validation issue

October 7, 2026 (updated October 20, 2026)

Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.

You are affected if:

You have enabled external URL-based upload retrieval, where authenticated requests can trigger it.

References

github.com/advisories/GHSA-pj5h-5q6c-3pfx
github.com/payloadcms/payload/commit/ba5cf6ae20d27a2c15106cb37466419031f86e6d
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-pj5h-5q6c-3pfx
nvd.nist.gov/vuln/detail/CVE-2026-105861

Code Behaviors & Features

Detect and mitigate CVE-2026-105861 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →