CVE-2026-25544 Details
Description
Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.
A blind SQL injection vulnerability has been identified in Payload CMS versions prior to 3.73.0, specifically within the JSON and richText fields. This issue arises because user input was directly inserted into SQL queries without proper escaping, allowing for exploitation. An unauthenticated attacker could leverage this vulnerability to extract sensitive information such as emails and password reset tokens, potentially leading to full account takeover without the need to crack passwords. The vulnerability affects users utilizing a Drizzle-based database adapter with accessible collections containing vulnerable field types.
Users are advised to upgrade to Payload CMS version 3.73.0 or later. If an immediate upgrade is not possible, as a temporary mitigation, add 'access: { read: () => false }' to all JSON and richText fields.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/payloadcms/payload/security/advisories/GHSA-xx6w-jxg9-2wh8 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| payloadcms payload | < 3.73.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 20, 2026 | Initial Analysis | [email protected] |
| Feb 6, 2026 | New CVE Received | [email protected] |