Security

SECURITY.md

Security Policy

Reporting a Vulnerability

Please report any security issues or concerns to info@payloadcms.com.

Unvalidated Input in Password Recovery Endpoints
GHSA-hp5w-3hxx-vmwf published Mar 30, 2026 by denolfe

Critical
Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
GHSA-frq9-7j6g-v74x published Mar 30, 2026 by denolfe

Moderate
CSRF Protection Bypass in Authentication Flow
GHSA-p6mr-xf3r-ghq4 published Mar 30, 2026 by denolfe

Moderate
Authenticated SSRF via Upload Functionality
GHSA-6r7f-q7f5-wpx8 published Mar 30, 2026 by denolfe

High
Stored XSS in Admin Panel
GHSA-mmxc-95ch-2j7c published Mar 30, 2026 by denolfe

High
SQL Injection via Query Handling
GHSA-7xxh-373w-35vg published Mar 30, 2026 by denolfe

High
Server-Side Request Forgery (SSRF) in External File URL Uploads
GHSA-hhfx-5x8j-f5f6 published Feb 23, 2026 by denolfe

Moderate
Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)
GHSA-jq29-r496-r955 published Feb 5, 2026 by denolfe

Moderate
SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
GHSA-xx6w-jxg9-2wh8 published Feb 5, 2026 by denolfe

Critical
Hidden fields can be leaked on readable collections
GHSA-35jj-vqcf-f2jf published Apr 26, 2023 by denolfe

High

Learn more about advisories related to payloadcms/payload in the GitHub Advisory Database