CVE-2026-58200 Details
Description
Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes attacker-controlled body.paramsToSign directly to cloudinary.utils.api_sign_request without a key allowlist, collection policy, timestamp freshness check, or configured-folder enforcement. Any authenticated Payload user can obtain a valid Cloudinary HMAC-SHA1 signature for unauthorized parameters such as overwrite, type, notification_url, invalidate, folder, and public_id. The signature can authorize asset replacement, upload visibility changes, callbacks to attacker-selected URLs, cache invalidation, and uploads outside the intended folder. The client-visible Cloudinary API key is expected by the upload design, but the unrestricted server-side signature supplies the authorization value needed to complete these operations. This vulnerability is fixed in 0.4.0.
A vulnerability exists in versions 0.3.0 prior to 0.4.0 of the @jhb.software/payload-cloudinary-plugin, which is designed to enhance Payload CMS. The issue arises when client uploads are enabled, as this configuration exposes a server-side signing endpoint that lacks proper validation. Specifically, the endpoint allows any authenticated user to obtain a valid Cloudinary HMAC-SHA1 signature for unauthorized parameters, including those that can overwrite existing assets or bypass access controls. The vulnerability is rooted in the absence of a key allowlist, collection policy enforcement, and a timestamp freshness check, enabling potential abuse of Cloudinary's API.
Users can update to version 0.4.0, which addresses the vulnerability by implementing proper parameter validation, enforcing collection and folder policies, and requiring fresh timestamps.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jhb-software/payload-plugins/commit/da2325901c5eeced17d33a1b2e647e300b8cbff2 | [email protected] | Source CodeVendor |
| https://github.com/jhb-software/payload-plugins/pull/155 | [email protected] | Issue TrackingVendor |
| https://github.com/jhb-software/payload-plugins/releases/tag/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/jhb-software/payload-plugins/security/advisories/GHSA-h5x8-xp6m-x6q4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JHB Software Payload Cloudinary Plugin | >= 0.3.0, < 0.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |