High severity · published Apr 1, 2026
CVE-2026-34747
Payload has an SQL Injection via Query Handling
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
payload · payloadcms
< 3.79.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34747
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34747
Product
https://github.com/payloadcms/payload/releases/tag/v3.79.1
Mitigation
https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg
More from payload
10.0
CVE-2026-105857
Payload: RCE in Payload Form Builder
9.8
CVE-2026-105859
Payload: Unauthorized update to collection documents
9.8
CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
9.8
CVE-2026-25544
Payload is a free and open source headless content management system
9.8
CVE-2022-27952
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file