CVE-2026-34747
published 2026-04-01CVE-2026-34747: Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker…
PriorityP349high8.2CVSS 3.1
AVNACLPRNUINSUCHILAN
EPSS
0.32%
24.0th percentile
Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| payloadcms | payload | < 3.79.1 | 3.79.1 |
| payloadcms | payload | >= 0 < 3.79.1 | 3.79.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Payload has an SQL Injection via Query Handling
ghsa·2026-04-01
CVE-2026-34747 [HIGH] CWE-89 Payload has an SQL Injection via Query Handling
Payload has an SQL Injection via Query Handling
### Impact
Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.
### Patches
This issue has been fixed in **v3.79.1** and later. Query input validation has been hardened.
Upgrade to **v3.79.1 or later**.
### Workarounds
Until developers can upgrade:
- Limit access to endpoints that accept dynamic query inputs to trusted users only.
- Validate or sanitize input from untrusted clients before sending it to query endpoints.
OSV
Payload has an SQL Injection via Query Handling
osv·2026-04-01
CVE-2026-34747 [HIGH] Payload has an SQL Injection via Query Handling
Payload has an SQL Injection via Query Handling
### Impact
Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.
### Patches
This issue has been fixed in **v3.79.1** and later. Query input validation has been hardened.
Upgrade to **v3.79.1 or later**.
### Workarounds
Until developers can upgrade:
- Limit access to endpoints that accept dynamic query inputs to trusted users only.
- Validate or sanitize input from untrusted clients before sending it to query endpoints.
No detection rules found.
No public exploits indexed.
2026-04-01
Published