CVE-2026-105867: Payload: Client uploads could overwrite S3 objects

Description

Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 12% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PA

payload · payloadcms

< 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 · source: vendor, NVD

ST

storage-s3 · @payloadcms

< 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 · source: vendor