CVE-2026-34746 Payload has Authenticated SSRF via Upload Functionality

What is CVE-2026-34746?

CVE-2026-34746 is a high-severity server-side request forgery vulnerability in payloadcms payload, published on 1 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1.

Weakness: CWE-918

Which versions are affected by CVE-2026-34746?

2 open source packages ship an affected version, including payload. It affects 1 product.

Products include Payloadcms Payload.

How do I fix CVE-2026-34746?

Upgrade payload to 3.79.1 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-34746 being exploited?

There is no known exploitation of CVE-2026-34746 in the wild and no public exploit code.

Other vulnerabilities in payloadcms payload

• CVE-2026-105857 Payload: RCE in Payload Form Builder Critical 10.0
• CVE-2026-105859 Payload: Unauthorized update to collection documents Critical 9.8
• CVE-2026-25544 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters Critical 9.8
• CVE-2022-27952 Unrestricted Upload of File with Dangerous Type in Payload Critical 9.8
• CVE-2026-105851 Payload: Field access control bypass on auth collections Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6r7f-q7f5-wpx8.