CVE-2026-34747

CVE-2026-34747 · Payload has an SQL Injection via Query Handling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.

CVSS 8.5 · High · EPSS 0.3% · Fix available

Published: 2026-04-01T19:45:24.463Z
Updated: 2026-04-04T03:07:40.291Z

Stack: node

Affected products and versions

payload
Versions
- < 3.79.1: Affected
No fix published
payload npm
Affected ranges
- SEMVER: < 3.79.1
Update to 3.79.1

Original sources

https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg
https://github.com/payloadcms/payload/releases/tag/v3.79.1
https://nvd.nist.gov/vuln/detail/CVE-2026-34747

Check your server →

CVE-2026-34747 · Payload has an SQL Injection via Query Handling

Affected products and versions

payload

payload npm

Original sources