CVE-2026-34748
published 2026-04-01CVE-2026-34748: Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS)…
PriorityP343high8.7CVSS 3.1
AVNACLPRLUIRSCCHIHAN
EPSS
0.29%
20.7th percentile
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| payloadcms | next | >= 0 < 3.78.0 | 3.78.0 |
| payloadcms | payload | < 3.78.0 | 3.78.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
@payloadcms/next has Stored XSS in Admin Panel
osv·2026-04-01
CVE-2026-34748 [HIGH] @payloadcms/next has Stored XSS in Admin Panel
@payloadcms/next has Stored XSS in Admin Panel
### Impact
A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser.
Consumers are affected if ALL of these are true:
- Payload version **< v3.78.0**
- At least one collection with versions enabled
- An authenticated user has `create` or `update` access to that collection
### Patches
This vulnerability has been patched in **v3.78.0**. Output encoding has been added to prevent user-supplied content from being interpreted as markup.
Users should upgrade to **v3.78.0** or later.
### Workarounds
If consumers cannot upgrade immediately:
- Restrict `create` and `update` access to
GHSA
@payloadcms/next has Stored XSS in Admin Panel
ghsa·2026-04-01
CVE-2026-34748 [HIGH] CWE-79 @payloadcms/next has Stored XSS in Admin Panel
@payloadcms/next has Stored XSS in Admin Panel
### Impact
A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser.
Consumers are affected if ALL of these are true:
- Payload version **< v3.78.0**
- At least one collection with versions enabled
- An authenticated user has `create` or `update` access to that collection
### Patches
This vulnerability has been patched in **v3.78.0**. Output encoding has been added to prevent user-supplied content from being interpreted as markup.
Users should upgrade to **v3.78.0** or later.
### Workarounds
If consumers cannot upgrade immediately:
- Restrict `create` and `update` access to
No detection rules found.
No public exploits indexed.
2026-04-01
Published