CVE-2026-105868: CWE-434: Unrestricted Upload of File with Dangerous Type in payloadcms payload

CVE-2026-105868 is a vulnerability in Payload CMS (a headless content management system) where unrestricted upload of files with dangerous types (specifically XML files with stylesheets) allows execution of JavaScript in the context of the Payload origin. This occurs when a logged-in user opens the uploaded file. The vulnerability affects versions prior to 3.90.0 and canary versions from 4.0.0-canary.0 up to but not including 4.0.0-canary.34. The issue is addressed in versions 3.90.0 and 4.0.0-canary.34.

An attacker able to upload XML files with embedded stylesheets can cause JavaScript execution in the context of the Payload CMS origin when a logged-in user opens the file. This can lead to high-impact consequences such as privilege escalation or data compromise within the CMS environment. The CVSS 4.0 score of 8.6 reflects high severity with network attack vector, low attack complexity, no privileges required beyond logged-in user, and user interaction required.

Upgrade Payload CMS to version 3.90.0 or later, or to 4.0.0-canary.34 or later. These versions contain the official fix for this vulnerability. No other mitigation is indicated or required according to the vendor advisory.