CVE-2026-25544
published 2026-02-06CVE-2026-25544: Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
0.77%
53.3th percentile
Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| payloadcms | drizzle | >= 0 < 3.73.0 | 3.73.0 |
| payloadcms | payload | < 3.73.0 | 3.73.0 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
ghsa·2026-02-05
CVE-2026-25544 [CRITICAL] CWE-89 @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
### Impact
When querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL Injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking.
**Users are affected if ALL of these are true:**
1. Payload version false }`
### Patches
Upgrade to Payload **v3.73.0** or later.
### Workarounds
If a project cannot upgrade immediately, add `access: { read: () => false }` to all JSON and richText fields as a temporary mitigation.
OSV
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
osv·2026-02-05
CVE-2026-25544 [CRITICAL] @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
### Impact
When querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL Injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking.
**Users are affected if ALL of these are true:**
1. Payload version false }`
### Patches
Upgrade to Payload **v3.73.0** or later.
### Workarounds
If a project cannot upgrade immediately, add `access: { read: () => false }` to all JSON and richText fields as a temporary mitigation.
No detection rules found.
2026-02-06
Published