CVE-2026-34747: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34747 is a SQL injection vulnerability in Payload CMS, a free and open-source headless content management system, affecting all versions prior to 3.79.1 for Node.js. The vulnerability arises from insufficient validation of certain request inputs, allowing attackers to craft requests that influence SQL query execution and potentially expose or modify data in collections. It was published by the National Vulnerability Database on April 1, 2026, following initial disclosure by the maintainer on March 30, 2026. The CVSS v3.1 base score is 8.5 (High) per the GitHub Advisory, or 8.2 (High) per NVD scoring (Github Advisory, Payload Advisory).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where Payload CMS constructs SQL queries using externally-influenced input without adequate sanitization or neutralization of SQL special elements (Github Advisory). The vulnerability is exploitable over the network with low attack complexity and requires low privileges (an authenticated user account), with no user interaction needed; the scope is changed, meaning the impact can extend beyond the vulnerable component itself (Payload Advisory). The fix, introduced in v3.79.1, includes stricter input validation (commit e474205, PR #15868) and a sanitizeWhereQuery call for join query access results (commit dc049fe, PR #15891) (Payload Release). No public proof-of-concept exploit code has been identified at this time.

Successful exploitation allows an attacker with low-level authenticated access to execute arbitrary SQL queries against the underlying database, resulting in high confidentiality impact through unauthorized data exposure and low integrity impact through potential data modification within collections (Github Advisory). The changed scope metric indicates that the impact can extend beyond the Payload CMS application itself to other components sharing the database. Availability is not directly impacted, but sensitive content managed through the CMS — including user data, content collections, and application configuration — is at risk of exfiltration or tampering (Payload Advisory).

There is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation at this time (Github Advisory). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.032% (0.000480 per Feedly data), placing it in the 10th percentile for exploitation probability within the next 30 days. The vulnerability was reported by security researchers hessandrew and arkmarta (Payload Advisory).

1. Reconnaissance: Identify internet-facing Payload CMS instances running versions prior to 3.79.1 using web application fingerprinting tools or by inspecting HTTP response headers and publicly accessible admin panels.
2. Obtain low-privilege access: Acquire or register a low-privilege user account on the target Payload CMS instance, as the vulnerability requires low privileges (PR:L).
3. Identify vulnerable query endpoints: Locate API endpoints that accept dynamic query inputs, such as collection query endpoints (e.g., /api/<collection>?where[field][operator]=value).
4. Craft malicious SQL injection payload: Construct a request with SQL injection payloads embedded in query parameters (e.g., where clauses or filter inputs) that are passed unsanitized to the underlying SQL query builder.
5. Execute and extract data: Send the crafted request and observe the response for signs of SQL query manipulation — such as unexpected data returned, error messages revealing database structure, or confirmation of data modification in collections (Github Advisory, Payload Advisory).

• Network: Unusual or malformed HTTP requests to Payload CMS API collection endpoints (e.g., /api/<collection>) containing SQL syntax characters (', --, OR, UNION, SELECT) in query parameters such as where, sort, or limit.
• Logs: Application or web server access logs showing repeated requests to query endpoints with encoded or unusual parameter values; database error messages or stack traces logged by the Node.js process indicating SQL parse errors.
• Application Behavior: Unexpected data returned in API responses inconsistent with the authenticated user's permissions; collections showing unexplained data modifications or deletions.
• Process: Unusual database query patterns in database audit logs, including queries with UNION SELECT, subqueries, or access to system tables not normally queried by the application (Github Advisory).

The primary remediation is to upgrade the payload npm package to v3.79.1 or later, which includes hardened query input validation (Payload Release, Github Advisory). For deployments where immediate upgrading is not feasible, the following temporary controls are recommended:

• Restrict access to endpoints that accept dynamic query inputs to trusted, authenticated users only.
• Implement server-side input validation or sanitization for any untrusted client inputs before they reach query endpoints.

Upgrading to v3.79.1 is the definitive fix and should be prioritized (Payload Advisory).

The vulnerability received coverage from The Hacker Wire, which published an article on the SQL injection issue via unvalidated input in Payload CMS (The Hacker Wire). The advisory was noted across several vulnerability tracking platforms including VulDB, CIRCL, and ENISA's EUVD shortly after disclosure. Community reaction on the Payload CMS GitHub repository was generally positive regarding the patch release, with contributors acknowledging the fix as part of the v3.79.1 release (Payload Release).