Please report any security issues or concerns to security@payloadcms.com.
Security: payloadcms/payload
Security
SECURITY.md
-
Polymorphic join queries could disclose hidden fieldsGHSA-fpww-c55p-cjv6 published
Sep 18, 2026 by DanRibbensHigh -
Uploaded XML files could execute same-origin JavaScriptGHSA-9qpg-3cf8-w33x published
Sep 18, 2026 by DanRibbensHigh -
Client uploads could overwrite S3 objectsGHSA-7vg8-29qx-jgj8 published
Sep 18, 2026 by DanRibbensHigh -
Unauthenticated account-lockout denial of serviceGHSA-v5gf-vpjc-pc7w published
Sep 18, 2026 by DanRibbensModerate -
Incomplete validation during the upload file lifecycleGHSA-p223-2wr2-j562 published
Sep 18, 2026 by DanRibbensHigh -
Cross-tenant create in @payloadcms/plugin-multi-tenantGHSA-xhm9-gwgw-3q2q published
Sep 18, 2026 by DanRibbensModerate -
Bypassed sanitization of user uploaded SVGsGHSA-2pwp-2369-8fg3 published
Sep 18, 2026 by DanRibbensHigh -
Payload authentication token field handling issueGHSA-66wr-7vmr-p5jq published
Sep 18, 2026 by DanRibbensCritical -
Order confirmation validation issue in Payload EcommerceGHSA-8r29-2mp2-pmrw published
Sep 18, 2026 by DanRibbensHigh -
Payload external upload trust validation issueGHSA-pj5h-5q6c-3pfx published
Sep 18, 2026 by DanRibbensHigh
Learn more about advisories related to payloadcms/payload in the GitHub Advisory Database