GHSA-2pwp-2369-8fg3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2pwp-2369-8fg3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2pwp-2369-8fg3/GHSA-2pwp-2369-8fg3.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2pwp-2369-8fg3
- Aliases
- Published
- 2026-10-07T20:29:36Z
- Modified
- 2026-10-07T20:45:04Z
- Severity
-
- 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- Payload: Bypassed sanitization of user uploaded SVGs
- Details
-
Impact
A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it.
You are affected if:
- You have a collection configured to upload and allow SVG files which can then be downloaded by users.
Patches
The fix validates SVG content on every upload path and hardens SVG/XML delivery so stored SVGs cannot frame attacker content.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
Disallow SVG uploads, or serve uploaded SVGs as downloads with Content-Disposition: attachment and a strict CSP. These mitigations reduce exposure but do not replace upgrading when the patched release is available.
- Database specific
{ "cwe_ids": [ "CWE-434", "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-10-07T20:29:36Z", "nvd_published_at": "2026-10-06T17:17:22Z", "severity": "HIGH" }- References
-
- https://github.com/payloadcms/payload/security/advisories/GHSA-2pwp-2369-8fg3
- https://nvd.nist.gov/vuln/detail/CVE-2026-105862
- https://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf
- https://github.com/payloadcms/payload
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
Affected packages
npm / payload
Package
- Name
- payload
- View open source insights on deps.dev
- Purl
- pkg:npm/payload
npm / payload
Package
- Name
- payload
- View open source insights on deps.dev
- Purl
- pkg:npm/payload