UpHeron
All vulnerabilities

Servers and applications

CVE-2026-105856

Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The…

Severity
High 8.6
Published
6 Oct 2026
Last changed
15 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.90.0
Sources
NVD

Affected software

SoftwareAffected versions
Payload CMSServers and applications · cpe:a:payloadcms:payload
  • Version 4.0.0-canary33
  • Version 4.0.0-canary32
  • Version 4.0.0-canary31
  • Version 4.0.0-canary30
All 35 release lines
  • Every version before 3.90.0
  • Version 4.0.0-canary0
  • Version 4.0.0-canary1
  • Version 4.0.0-canary2
  • Version 4.0.0-canary3
  • Version 4.0.0-canary4
  • Version 4.0.0-canary5
  • Version 4.0.0-canary6
  • Version 4.0.0-canary7
  • Version 4.0.0-canary8
  • Version 4.0.0-canary9
  • Version 4.0.0-canary10
  • Version 4.0.0-canary11
  • Version 4.0.0-canary12
  • Version 4.0.0-canary13
  • Version 4.0.0-canary14
  • Version 4.0.0-canary15
  • Version 4.0.0-canary16
  • Version 4.0.0-canary17
  • Version 4.0.0-canary18
  • Version 4.0.0-canary19
  • Version 4.0.0-canary20
  • Version 4.0.0-canary21
  • Version 4.0.0-canary22
  • Version 4.0.0-canary23
  • Version 4.0.0-canary24
  • Version 4.0.0-canary25
  • Version 4.0.0-canary26
  • Version 4.0.0-canary27
  • Version 4.0.0-canary28
  • Version 4.0.0-canary29
  • Version 4.0.0-canary30
  • Version 4.0.0-canary31
  • Version 4.0.0-canary32
  • Version 4.0.0-canary33

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-105856
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-105856