CVE-2026-105865 payloadcms CVE debrief

Who should care

Users of Payload upload collections with local file storage, especially those with untrusted authenticated users who can update or delete uploads, should be aware of this vulnerability. The potential for data loss or service disruption requires immediate attention, particularly for operators managing such systems. Security teams should assess exposure, prioritize remediation, and consider compensating controls until patches can be applied.

Why it matters

CVE-2026-105865 is significant for users of Payload upload collections with local file storage, particularly when untrusted authenticated users can update or delete uploads. The vulnerability could lead to data loss or service disruption. Users should assess exposure, prioritize remediation, and consider compensating controls.

• Data loss due to unintended file removal
• Service disruption due to file cleanup issues
• Need to verify and restrict upload management to trusted users
• Requirement to validate submitted filenames

Technical summary

Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup, potentially resulting in data loss or service disruption. This issue arises in Payload upload collections with local file storage when untrusted authenticated users can update or delete uploads. The vulnerability is addressed by validating uploaded filenames and ensuring file cleanup remains within the configured upload directory in Payload packages >= 3.90.0 or >= 4.0.0-canary.34.

Defensive priority

Upgrade to patched versions; restrict upload management to trusted users; validate submitted filenames.

Recommended defensive actions

• Upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34
• Restrict upload update and deletion operations to trusted users
• Validate submitted filenames
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability and patches. Evidence is based on official CVE Program and NIST NVD records, as well as source-specific vulnerability assessments. The CVE record was published on 2026-10-07T20:29:09.000Z and has not been modified since then. The source item from osv_dev also provides relevant information about the vulnerability. However, the impact and mitigation strategies suggest that additional verification may be necessary to ensure complete exposure assessment and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.