CVE-2026-34746: Payload has Authenticated SSRF via Upload Functionality

April 1, 2026 (updated April 6, 2026)

An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.

Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.

Consumers are affected if ALL of these are true:

Payload version < v3.79.1
At least one collection with upload enabled
An authenticated user has create or update access to that collection

References

github.com/advisories/GHSA-6r7f-q7f5-wpx8
github.com/payloadcms/payload
github.com/payloadcms/payload/releases/tag/v3.79.1
github.com/payloadcms/payload/security/advisories/GHSA-6r7f-q7f5-wpx8
nvd.nist.gov/vuln/detail/CVE-2026-34746

Code Behaviors & Features

Detect and mitigate CVE-2026-34746 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →