Security

SECURITY.md

Security Policy

Reporting a Vulnerability

Please report any security issues or concerns to security@payloadcms.com.

Untrusted redirect URL parameter exploit
GHSA-w84c-53h3-mc2g published Sep 22, 2026 by DanRibbens

Moderate
Sort queries could expose protected field information
GHSA-9g87-32v6-3c2r published Sep 22, 2026 by DanRibbens

Moderate
Improper access control for MCP API keys
GHSA-2q76-m6w6-qgc6 published Sep 22, 2026 by DanRibbens

High
Prototype pollution in Payload Import Export plugin
GHSA-qf28-8hc6-vwrp published Sep 22, 2026 by DanRibbens

Critical
SQL Injection in SQLite and Postgres
GHSA-v49j-62m6-pgrr published Sep 22, 2026 by DanRibbens

Critical
Polymorphic join queries could disclose hidden fields
GHSA-fpww-c55p-cjv6 published Sep 18, 2026 by DanRibbens

High
Uploaded XML files could execute same-origin JavaScript
GHSA-9qpg-3cf8-w33x published Sep 18, 2026 by DanRibbens

High
Client uploads could overwrite S3 objects
GHSA-7vg8-29qx-jgj8 published Sep 18, 2026 by DanRibbens

High
Unauthenticated account-lockout denial of service
GHSA-v5gf-vpjc-pc7w published Sep 18, 2026 by DanRibbens

Moderate
Incomplete validation during the upload file lifecycle
GHSA-p223-2wr2-j562 published Sep 18, 2026 by DanRibbens

High

Learn more about advisories related to payloadcms/payload in the GitHub Advisory Database