Payload: SQL Injection in SQLite and Postgres

Description

A user can submit a request that exploits a SQL Injection vulnerability in Payload.

You are affected if:

• You use an affected Payload version.
• Untrusted users can query readable collections using dynamic filters or joins.

You are not affected if you use MongoDB (@payloadcms/mongodb).

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.27

  >= 3.0.0, < 3.88.0**

• Patched version(s): **4.0.0-canary.27

  3.88.0**

References

• GHSA-v49j-62m6-pgrr
• CVE-2026-105845
• CWE-89
• CAPEC-310