{"id":"CVE-2026-34747","aliases":["EUVD-2026-18013","GHSA-7xxh-373w-35vg"],"status":"published","title":"Payload has an SQL Injection via Query Handling","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00322,"percentile":0.25443,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-04-01T19:45:24Z","modified":"2026-10-28T02:30:26Z","fixes":[{"ecosystem":"npm","package":"payload","fixed_in":["3.79.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"payload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.1"}]}]},{"source":"osv","ecosystem":"npm","package":"payload","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.79.1"}]}]}],"products":[{"vendor":"payloadcms","product":"payload"}],"references":[{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.79.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34747","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7xxh-373w-35vg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34747.json","tags":["advisory"]},{"url":"https://github.com/payloadcms/payload","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34747","title":"Payload has an SQL Injection via Query Handling","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.","status":"published","published":"2026-04-01T19:45:24.463Z","modified":"2026-04-04T03:07:40.291Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-18013","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.","status":"published","published":"2026-04-01T19:45:24Z","modified":"2026-04-04T03:07:40Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:16.550278Z"}],"ghsa":[{"id":"GHSA-7xxh-373w-35vg","title":"Payload has an SQL Injection via Query Handling","description":"### Impact\n\nCertain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.\n\n### Patches\n\nThis issue has been fixed in **v3.79.1** and later. Query input validation has been hardened.\n\nUpgrade to **v3.79.1 or later**.\n\n### Workarounds\n\nUntil developers can upgrade:\n\n- Limit access to endpoints that accept dynamic query inputs to trusted users only.  \n- Validate or sanitize input from untrusted clients before sending it to query endpoints.","status":"published","published":"2026-04-01T21:19:03Z","modified":"2026-04-06T16:46:42Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:39:47.945242Z"}],"nvd":[{"id":"CVE-2026-34747","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.","status":"published","published":"2026-04-01T20:16:26.887Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:12.73929Z"}],"osv":[{"id":"CVE-2026-34747","title":"Payload has an SQL Injection via Query Handling","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.","status":"published","published":"2026-04-01T19:45:24.463Z","modified":"2026-10-28T02:30:26.486239355Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-7xxh-373w-35vg","title":"Payload has an SQL Injection via Query Handling","description":"### Impact\n\nCertain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.\n\n### Patches\n\nThis issue has been fixed in **v3.79.1** and later. Query input validation has been hardened.\n\nUpgrade to **v3.79.1 or later**.\n\n### Workarounds\n\nUntil developers can upgrade:\n\n- Limit access to endpoints that accept dynamic query inputs to trusted users only.  \n- Validate or sanitize input from untrusted clients before sending it to query endpoints.","status":"published","published":"2026-04-01T21:19:03Z","modified":"2026-04-06T17:03:39.306874Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:41.732368Z"}]}}