p PatchFirst

PatchFirst · Latest vulnerabilities

@jhb.software/payload-cloudinary-plugin vulnerabilities

Vulnerabilities published for @jhb.software/payload-cloudinary-plugin in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-58200

    High · CVSS 7.1EPSS 0.31%Fix available

    @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

    Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes attacker-controlled body.paramsToSign directly to cloudinary.utils.api_sign_request without a key allowlist, collection policy, timestamp freshness check, or configured-folder enforcement. Any authenticated Payload user can obtain a valid Cloudinary HMAC-SHA1 signature for unauthorized parameters such as overwrite, type, notification_url, invalidate, folder,

    @jhb.software/payload-cloudinary-pluginNode.js
    • Update to 0.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →