Critical severity · published Feb 6, 2026
CVE-2026-25544
Payload is a free and open source headless content management system
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Payload · Payloadcms
before 3.73.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25544
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25544
Vendor Advisory
https://github.com/payloadcms/payload/security/advisories/GHSA-xx6w-jxg9-2wh8
More from Payload
10.0
CVE-2026-105857
Payload: RCE in Payload Form Builder
9.8
CVE-2026-105859
Payload: Unauthorized update to collection documents
9.8
CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
9.8
CVE-2022-27952
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file
9.6
CVE-2026-105848
Payload: Insufficient Access Control in Stripe REST Proxy