CVE-2026-105862: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in payloadcms payload

PayloadCMS, a headless content management system, has a CWE-79 (Cross-site Scripting) vulnerability in versions prior to 3.90.0 and canary versions prior to 4.0.0-canary.34. The issue arises from improper neutralization of input during web page generation, specifically in collections that permit downloadable SVG uploads. Malicious SVG files can bypass sanitization controls and execute arbitrary JavaScript when a user downloads and opens the SVG file. This vulnerability has a CVSS 3.1 score of 8.7, indicating high severity, with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality and integrity with a scope change.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when the malicious SVG is downloaded and opened. This can lead to high confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of the user. There is no reported impact on availability. No known exploits in the wild have been reported.

Upgrade to PayloadCMS version 3.90.0 or later, or to canary version 4.0.0-canary.34 or later, where this vulnerability is fixed. No other mitigation is specified or required once the update is applied.