CVE-2026-34748
CVE-2026-34748 · @payloadcms/next has Stored XSS in Admin Panel
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.
CVSS 8.7 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
payload
- Versions
- < 3.78.0: Affected
No fix published
@payloadcms/next npm
- Affected ranges
- SEMVER: < 3.78.0
Update to 3.78.0