fkie_cve-2026-105845

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

GHSA-v49j-62m6-pgrr — Payload: SQL Injection in SQLite and Postgres

Affected: npm: payload

### Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload.

You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins.

You are not affected if you use MongoDB (`@payloadcms/mongodb`).

### Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`.

### Workarounds Upgrading to a patched version is recommended. Until you can upgrade, restrict untrusted users from supplying dynamic query filters or join parameters and limit read access to affected collections.

Most recent entries from all

fkie_cve-2026-105845

GHSA-v49j-62m6-pgrr — Payload: SQL Injection in SQLite and Postgres