CVE-2026-105856: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in payloadcms payload

CVE-2026-105856 is an SQL injection vulnerability in Payload CMS affecting versions >=3.0.0 and <3.90.0, >=4.0.0-canary.0 and <4.0.0-canary.34 for SQLite packages, and >=3.0.0 and <3.73.0 for Postgres packages. The vulnerability arises when an attacker with read and create or update access to collections containing json fields or blocks fields with blocksAsJSON enabled crafts malicious field paths and operators to inject SQL commands. Collections without these fields and richText fields are not vulnerable. The vulnerability is addressed in Payload CMS versions 3.90.0 and 4.0.0-canary.34 for SQLite, and 3.73.0 for Postgres.

An attacker with limited privileges (read and create or update access) can exploit this vulnerability to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation within affected collections. The vulnerability is limited to collections with specific field configurations (json or blocks with blocksAsJSON enabled).

Upgrade affected Payload CMS installations to version 3.90.0 or later for SQLite packages, or version 3.73.0 or later for Postgres packages. These versions contain official fixes that address the SQL injection vulnerability. No additional mitigations are indicated by the vendor advisory.