Payloadcms Storage-S3 vulnerabilities
2 known vulnerabilities affecting payloadcms/storage-s3.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2026-105867P3MEDIUMCVSS 6.5fixed in 3.90.0v>= 4.0.0-canary.0, < 4.0.0-canary.342026-10-06
CVE-2026-105867 [MEDIUM] CWE-639 CVE-2026-105867: Payload is a free and open source headless content management system. In @payloadcms/storage-s3 vers
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useComposit
ghsanvd
CVE-2026-34750P3MEDIUM≥ 0, < 3.78.02026-04-01
CVE-2026-34750 [MEDIUM] CWE-22 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
### Impact
The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location.
Consumers are affected if ALL of these are true:
- Payload version **< v3.78.0**
- Using client-upload signed-
ghsaosv