CVE-2026-105862: Payload: Bypassed sanitization of user uploaded SVGs

October 7, 2026

A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it.

You are affected if:

You have a collection configured to upload and allow SVG files which can then be downloaded by users.

References

github.com/advisories/GHSA-2pwp-2369-8fg3
github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-2pwp-2369-8fg3
nvd.nist.gov/vuln/detail/CVE-2026-105862

Code Behaviors & Features

Detect and mitigate CVE-2026-105862 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →