{"id":"CVE-2026-105845","published":"2026-10-06T16:17:06.540","lastModified":"2026-10-06T20:03:40.690","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a","tags":[]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.88.0","tags":[]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-v49j-62m6-pgrr","tags":[]}],"exploitRefs":[{"url":"https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a","tags":[]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.88.0","tags":[]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-v49j-62m6-pgrr","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows untrusted users to perform SQL injection attacks by submitting crafted requests through dynamic filters or joins, leading to potential data compromise, integrity issues, and system availability problems.","exploitability":"Exploitation is relatively straightforward for an attacker who can query readable collections, as no specific technical skills beyond basic SQL knowledge are required.","blast_radius":"If exploited, the impact could be severe, potentially leading to data theft, system compromise, and service disruption for users of the affected versions.","remediation":"Upgrade to version 3.88.0 or 4.0.0-canary.27 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","sql-injection","web","content-management"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:43:03.729Z"}}