Description
An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.
Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.79.1
- Patched version(s): 3.79.1
References
Related Issues
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - CVE-2026-34750
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-azure - CVE-2026-34750
- Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-r2 - CVE-2026-34750
You might also like:
- Tags:
- npm
- payload
Anything's wrong? Let us know Last updated on April 06, 2026