UpHeron
All vulnerabilities

Servers and applications

CVE-2026-105865

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to…

Severity
High 8.1
Published
6 Oct 2026
Last changed
15 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.90.0
Sources
NVD

Affected software

SoftwareAffected versions
Payload CMSServers and applications · cpe:a:payloadcms:payload
  • Version 4.0.0-canary33
  • Version 4.0.0-canary32
  • Version 4.0.0-canary31
  • Version 4.0.0-canary30
All 35 release lines
  • Every version before 3.90.0
  • Version 4.0.0-canary0
  • Version 4.0.0-canary1
  • Version 4.0.0-canary2
  • Version 4.0.0-canary3
  • Version 4.0.0-canary4
  • Version 4.0.0-canary5
  • Version 4.0.0-canary6
  • Version 4.0.0-canary7
  • Version 4.0.0-canary8
  • Version 4.0.0-canary9
  • Version 4.0.0-canary10
  • Version 4.0.0-canary11
  • Version 4.0.0-canary12
  • Version 4.0.0-canary13
  • Version 4.0.0-canary14
  • Version 4.0.0-canary15
  • Version 4.0.0-canary16
  • Version 4.0.0-canary17
  • Version 4.0.0-canary18
  • Version 4.0.0-canary19
  • Version 4.0.0-canary20
  • Version 4.0.0-canary21
  • Version 4.0.0-canary22
  • Version 4.0.0-canary23
  • Version 4.0.0-canary24
  • Version 4.0.0-canary25
  • Version 4.0.0-canary26
  • Version 4.0.0-canary27
  • Version 4.0.0-canary28
  • Version 4.0.0-canary29
  • Version 4.0.0-canary30
  • Version 4.0.0-canary31
  • Version 4.0.0-canary32
  • Version 4.0.0-canary33

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-105865
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-105865