CVE-2026-34750
CVE-2026-34750 · Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3.
CVSS 6.5 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
payload
- Versions
- < 3.78.0: Affected
No fix published
@payloadcms/storage-azure npm
- Affected ranges
- SEMVER: < 3.78.0
Update to 3.78.0
@payloadcms/storage-gcs npm
- Affected ranges
- SEMVER: < 3.78.0
Update to 3.78.0
@payloadcms/storage-r2 npm
- Affected ranges
- SEMVER: < 3.78.0
Update to 3.78.0
@payloadcms/storage-s3 npm
- Affected ranges
- SEMVER: < 3.78.0
Update to 3.78.0