Dashboard / CVE-2026-34750

CVE-2026-34750

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 63/100
Published: 2026-04-01 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: High
A: None

Description

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
payloadcms payload < 3.78.0

References & Advisories (1)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS — Exploitation Probability

0.36%
Raw Score 0.003550
Percentile 29.2%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00355
2026-10-28
0.00341

Intelligence Sources

nvd ref →

External Links