Description
A vulnerability in @payloadcms/plugin-form-builder in versions < 3.90.0 allow submissions which could be crafted to execute remote code on the server.
You are affected if:
- You are using
@payloadcms/plugin-form-builder
Recommendation
Update the @payloadcms/plugin-form-builder package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34 < 3.90.0** Patched version(s): **4.0.0-canary.34 3.90.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload Form Builder has an RCE issue and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - CVE-2026-34750
- SillyTavern has a Path Traversal issue - CVE-2026-44650
- React Router has CSRF issue in Action/Server Action Request Processing - CVE-2026-22030
You might also like:
See something that needs correcting? Let us knowUpdated October 07, 2026