CVE-2026-34750
published 2026-04-01CVE-2026-34750: Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.34%
26.9th percentile
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| payloadcms | payload | < 3.78.0 | 3.78.0 |
| payloadcms | storage-azure | >= 0 < 3.78.0 | 3.78.0 |
| payloadcms | storage-gcs | >= 0 < 3.78.0 | 3.78.0 |
| payloadcms | storage-r2 | >= 0 < 3.78.0 | 3.78.0 |
| payloadcms | storage-s3 | >= 0 < 3.78.0 | 3.78.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
ghsa·2026-04-01
CVE-2026-34750 [MEDIUM] CWE-22 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
### Impact
The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location.
Consumers are affected if ALL of these are true:
- Payload version **< v3.78.0**
- Using client-upload signed-URL endpoints for any supported storage adapter
## Patches
This vulnerability has been patched in **v3.78.0**. Filename validation has been hardened for client uploads.
Consumers should upgrade to **v3.78.0** or later.
## Workarounds
Consumers can upgrade:
- Limit access to client-upload signed-URL endpoints to trusted users only.
OSV
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
osv·2026-04-01
CVE-2026-34750 [MEDIUM] Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
### Impact
The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location.
Consumers are affected if ALL of these are true:
- Payload version **< v3.78.0**
- Using client-upload signed-URL endpoints for any supported storage adapter
## Patches
This vulnerability has been patched in **v3.78.0**. Filename validation has been hardened for client uploads.
Consumers should upgrade to **v3.78.0** or later.
## Workarounds
Consumers can upgrade:
- Limit access to client-upload signed-URL endpoints to trusted users only.
No detection rules found.
No public exploits indexed.
2026-04-01
Published