CVE-2026-34746
published 2026-04-01CVE-2026-34746: Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF)…
PriorityP352high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.30%
22.2th percentile
Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| payloadcms | payload | < 3.79.1 | 3.79.1 |
| payloadcms | payload | >= 0 < 3.79.1 | 3.79.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Payload has Authenticated SSRF via Upload Functionality
ghsa·2026-04-01
CVE-2026-34746 [HIGH] CWE-918 Payload has Authenticated SSRF via Upload Functionality
Payload has Authenticated SSRF via Upload Functionality
### Impact
An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.
Authenticated users with `create` or `update` access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.
Consumers are affected if ALL of these are true:
- Payload version **< v3.79.1**
- At least one collection with `upload` enabled
- An authenticated user has `create` or `update` access to that collection
### Patches
This vulnerability has been patched in **v3.79.1**. Users should upgrade to **v3.79.1** or later.
### Workarounds
Until consumers can upgrade:
- Restrict `create` and `update` access to upload-enabled collections to trusted roles only.
- Limit ou
OSV
Payload has Authenticated SSRF via Upload Functionality
osv·2026-04-01
CVE-2026-34746 [HIGH] Payload has Authenticated SSRF via Upload Functionality
Payload has Authenticated SSRF via Upload Functionality
### Impact
An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.
Authenticated users with `create` or `update` access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.
Consumers are affected if ALL of these are true:
- Payload version **< v3.79.1**
- At least one collection with `upload` enabled
- An authenticated user has `create` or `update` access to that collection
### Patches
This vulnerability has been patched in **v3.79.1**. Users should upgrade to **v3.79.1** or later.
### Workarounds
Until consumers can upgrade:
- Restrict `create` and `update` access to upload-enabled collections to trusted roles only.
- Limit ou
No detection rules found.
No public exploits indexed.
2026-04-01
Published