CVE-2026-34748 @payloadcms/next has Stored XSS in Admin Panel

What is CVE-2026-34748?

CVE-2026-34748 is a high-severity cross-site scripting vulnerability in payloadcms payload, published on 1 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.

Weakness: CWE-79

Which versions are affected by CVE-2026-34748?

2 open source packages ship an affected version, including @payloadcms/next. It affects 1 product.

Products include Payloadcms Payload.

How do I fix CVE-2026-34748?

Upgrade @payloadcms/next to 3.78.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-34748 being exploited?

There is no known exploitation of CVE-2026-34748 in the wild and no public exploit code.

Other vulnerabilities in payloadcms payload

• CVE-2026-105857 Payload: RCE in Payload Form Builder Critical 10.0
• CVE-2026-105859 Payload: Unauthorized update to collection documents Critical 9.8
• CVE-2026-25544 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters Critical 9.8
• CVE-2022-27952 Unrestricted Upload of File with Dangerous Type in Payload Critical 9.8
• CVE-2026-105851 Payload: Field access control bypass on auth collections Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mmxc-95ch-2j7c.