CVE-2026-34746: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34746 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in the upload functionality of Payload CMS, a free and open-source headless content management system. It affects all Payload npm package versions prior to 3.79.1 running on Node.js. The vulnerability was published on March 30, 2026 by maintainer denolfe via a GitHub Security Advisory, and formally published to the NVD on April 1, 2026. It carries a CVSS v3.1 base score of 7.7 (High) (Github Advisory, Payload Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and stems from insufficient input validation in Payload's upload functionality, where user-supplied URLs are not adequately restricted before the server initiates outbound HTTP requests. An authenticated attacker with create or update permissions on any upload-enabled collection can supply an arbitrary URL as part of an upload request, causing the Payload server to fetch that URL on the attacker's behalf. Exploitation requires three conditions to be met simultaneously: the Payload version must be below v3.79.1, at least one collection must have upload enabled, and the attacker must hold create or update access to that collection. The fix included in v3.79.1 introduces stricter input validation (commit e474205) (Github Advisory, Payload Release).

Successful exploitation allows an attacker to force the Payload server to make outbound HTTP requests to arbitrary URLs, including internal network addresses and cloud metadata endpoints (e.g., http://169.254.169.254). The primary impact is high confidentiality loss — attackers can access internal services, exfiltrate sensitive data from systems not directly reachable from the internet, perform internal network reconnaissance, and interact with internal APIs. Integrity and availability are not directly impacted by this vulnerability. The changed scope in the CVSS rating reflects that the impact extends beyond the Payload application itself to other internal systems (Github Advisory, Payload Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Github Advisory). No threat actor attribution has been reported. The EPSS score is approximately 0.017% (4th percentile), indicating a low near-term probability of exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a Payload CMS instance running a version prior to v3.79.1 with at least one upload-enabled collection. This can be done by reviewing publicly accessible Payload admin panels or API endpoints.
2. Obtain authenticated access: Acquire valid credentials for an account with create or update permissions on an upload-enabled collection. This could be through legitimate access, credential theft, or social engineering.
3. Craft malicious upload request: Submit an HTTP request to the upload endpoint of the target collection, supplying a URL pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata, or an internal service like http://internal-db:5432) as the file source URL.
4. Retrieve server response: Observe the server's response or any error messages that reflect content fetched from the target URL, enabling enumeration of internal services, cloud credentials, or sensitive configuration data (Github Advisory, Payload Advisory).

• Network: Unusual outbound HTTP requests from the Payload server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254); unexpected connections to non-standard external hosts initiated by the Node.js process.
• Logs: Payload application logs showing upload requests with URL parameters pointing to internal addresses or metadata services; HTTP client errors or timeouts in server logs related to internal host resolution.
• Process: The Payload Node.js process initiating outbound TCP connections to ports associated with internal services (e.g., databases, caches, admin interfaces) that would not normally be contacted during upload operations.

The vulnerability is patched in Payload v3.79.1, released March 16, 2026; all users should upgrade immediately (Payload Release). For deployments that cannot upgrade immediately, two interim workarounds are recommended: restrict create and update access on all upload-enabled collections to explicitly trusted roles only, and limit outbound network access from the Payload server using firewall rules or network segmentation to prevent requests to internal services and metadata endpoints (Github Advisory).

The vulnerability received coverage from security aggregators and community feeds shortly after disclosure, including mentions on Mastodon via The Hacker Wire and coverage by vulnerability tracking services such as VulDB and INCIBE-CERT. No notable independent researcher commentary or significant media coverage beyond standard vulnerability aggregation has been identified.