Security

SECURITY.md

Security Policy

Reporting a Vulnerability

Please report any security issues or concerns to security@payloadcms.com.

Field-level write access bypass in Payload on MongoDB
GHSA-4ww4-68q3-h7g5 published Aug 27, 2026 by DanRibbens
High
Unvalidated Input in Password Recovery Endpoints
GHSA-hp5w-3hxx-vmwf published Mar 30, 2026 by denolfe
Critical
Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
GHSA-frq9-7j6g-v74x published Mar 30, 2026 by denolfe
Moderate
CSRF Protection Bypass in Authentication Flow
GHSA-p6mr-xf3r-ghq4 published Mar 30, 2026 by denolfe
Moderate
Authenticated SSRF via Upload Functionality
GHSA-6r7f-q7f5-wpx8 published Mar 30, 2026 by denolfe
High
Stored XSS in Admin Panel
GHSA-mmxc-95ch-2j7c published Mar 30, 2026 by denolfe
High
SQL Injection via Query Handling
GHSA-7xxh-373w-35vg published Mar 30, 2026 by denolfe
High
Server-Side Request Forgery (SSRF) in External File URL Uploads
GHSA-hhfx-5x8j-f5f6 published Feb 23, 2026 by denolfe
Moderate
Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)
GHSA-jq29-r496-r955 published Feb 5, 2026 by denolfe
Moderate
SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
GHSA-xx6w-jxg9-2wh8 published Feb 5, 2026 by denolfe
Critical

Learn more about advisories related to payloadcms/payload in the GitHub Advisory Database