Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in Payload’s external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources.

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.75.0
• Patched version(s): 3.75.0

References

• GHSA-hhfx-5x8j-f5f6
• CVE-2026-27567
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis - CVE-2026-46391
• pdfmake is vulnerable to server-side request forgery (SSRF) - CVE-2026-26801
• Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829
• Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url - CVE-2022-2900

You might also like:

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

Update Cheat Sheet for Developers

Tags:

npm

payload