CVE-2026-105868 payloadcms CVE debrief

Who should care

Defenders and administrators of Payload installations that accept XML uploads should assess exposure and prioritize upgrading to >= 3.90.0 or >= 4.0.0-canary.34. Additionally, security teams and vulnerability management teams should review their configurations and adjust them to prevent XML/XSL file uploads. Operators and platform administrators should also review their systems and prioritize upgrading to prevent potential JavaScript execution.

Why it matters

CVE-2026-105868 allows uploaded XML files and stylesheets to execute JavaScript in the Payload origin when opened by a logged-in user. Defenders should prioritize upgrading Payload packages and disallow XML/XSL uploads to prevent potential JavaScript execution.

• Verify and upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34 to prevent JavaScript execution from uploaded XML files.
• Disallow XML/XSL uploads to prevent potential JavaScript execution in the Payload origin.
• Review and adjust upload configurations to prevent XML/XSL file uploads and limit exposure.

Technical summary

CVE-2026-105868: Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. This vulnerability exists in Payload installations that accept XML uploads, which is the default configuration. The vulnerability allows an attacker to execute JavaScript in the Payload origin, potentially leading to security breaches. Defenders should prioritize upgrading Payload packages to >= 3.90.0 or >= 4.0.0-canary.34 and disallow XML/XSL uploads.

Defensive priority

Defenders should prioritize upgrading Payload packages to >= 3.90.0 or >= 4.0.0-canary.34 and disallow XML/XSL uploads.

Recommended defensive actions

• Upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34
• Disallow XML/XSL uploads
• Review and adjust upload configurations to prevent XML/XSL file uploads
• Verify and upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34 to prevent JavaScript execution from uploaded XML files
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from osv_dev indicates that uploaded XML files and stylesheets could execute JavaScript in the Payload origin when a logged-in user opens the file under certain local upload configurations. The evidence suggests that this vulnerability exists in Payload installations that accept XML uploads, which is the default configuration. Defenders should verify their Payload installations and assess their exposure to this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.