CVE-2026-25544 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

What is CVE-2026-25544?

CVE-2026-25544 is a critical SQL injection vulnerability in payloadcms payload, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.

Weakness: CWE-89

Which versions are affected by CVE-2026-25544?

2 open source packages ship an affected version, including @payloadcms/drizzle. It affects 1 product.

Products include Payloadcms Payload.

How do I fix CVE-2026-25544?

Upgrade @payloadcms/drizzle to 3.73.0 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-25544 being exploited?

There is no known exploitation of CVE-2026-25544 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in payloadcms payload

• CVE-2026-105857 Payload: RCE in Payload Form Builder Critical 10.0
• CVE-2026-105859 Payload: Unauthorized update to collection documents Critical 9.8
• CVE-2022-27952 Unrestricted Upload of File with Dangerous Type in Payload Critical 9.8
• CVE-2026-105851 Payload: Field access control bypass on auth collections Critical 9.3
• CVE-2026-105863 Payload authentication token field handling issue Critical 9.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xx6w-jxg9-2wh8.