CVE-2026-105865: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in payloadcms payload

PayloadCMS, a headless content management system, has a path traversal vulnerability (CWE-22) in versions before 3.90.0 and canary versions before 4.0.0-canary.34. An authenticated user authorized to update or delete uploads stored locally can exploit this flaw to cause the file cleanup process to remove files outside the configured upload directory. This improper limitation of pathname can result in data loss or disruption of service. Deployments that limit upload management to trusted users reduce exposure. The issue is resolved in versions 3.90.0 and 4.0.0-canary.34.

Exploitation requires authenticated user privileges with upload management rights. Successful exploitation can cause removal of unintended files outside the upload directory, leading to data loss and service disruption. There is no indication of confidentiality impact. The vulnerability has a high CVSS score (8.1) reflecting the integrity and availability impact.

Upgrade to PayloadCMS version 3.90.0 or later, or 4.0.0-canary.34 or later, where the vulnerability is fixed. Restrict upload management permissions to trusted users to reduce exposure until the upgrade can be applied.