CVE-2026-27567

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27567", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T17:40:28.448Z", "datePublished": "2026-02-24T14:22:37.803Z", "dateUpdated": "2026-02-27T19:03:28.091Z"}, "containers": {"cna": {"title": "Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/payloadcms/payload/security/advisories/GHSA-hhfx-5x8j-f5f6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-hhfx-5x8j-f5f6"}, {"name": "https://github.com/payloadcms/payload/commit/1041bb6", "tags": ["x_refsource_MISC"], "url": "https://github.com/payloadcms/payload/commit/1041bb6"}, {"name": "https://github.com/payloadcms/payload/releases/tag/v3.75.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/payloadcms/payload/releases/tag/v3.75.0"}], "affected": [{"vendor": "payloadcms", "product": "payload", "versions": [{"version": "< 3.75.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T14:22:37.803Z"}, "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at least one collection with `upload` enabled and a user who has `create` access to that upload-enabled collection in order to be vulnerable. An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application. This vulnerability has been patched in v3.75.0. As a workaround, one may mitigate this vulnerability by disabling external file uploads via the `disableExternalFile` upload collection option, or by restricting `create` access on upload-enabled collections to trusted users only."}], "source": {"advisory": "GHSA-hhfx-5x8j-f5f6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T19:03:18.715822Z", "id": "CVE-2026-27567", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T19:03:28.091Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27567", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-27T19:03:18.715822Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T19:03:23.855Z"}}], "cna": {"title": "Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads", "source": {"advisory": "GHSA-hhfx-5x8j-f5f6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "payloadcms", "product": "payload", "versions": [{"status": "affected", "version": "< 3.75.0"}]}], "references": [{"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-hhfx-5x8j-f5f6", "name": "https://github.com/payloadcms/payload/security/advisories/GHSA-hhfx-5x8j-f5f6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/payloadcms/payload/commit/1041bb6", "name": "https://github.com/payloadcms/payload/commit/1041bb6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/payloadcms/payload/releases/tag/v3.75.0", "name": "https://github.com/payloadcms/payload/releases/tag/v3.75.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at least one collection with `upload` enabled and a user who has `create` access to that upload-enabled collection in order to be vulnerable. An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application. This vulnerability has been patched in v3.75.0. As a workaround, one may mitigate this vulnerability by disabling external file uploads via the `disableExternalFile` upload collection option, or by restricting `create` access on upload-enabled collections to trusted users only."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T14:22:37.803Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27567", "state": "PUBLISHED", "dateUpdated": "2026-02-27T19:03:28.091Z", "dateReserved": "2026-02-20T17:40:28.448Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T14:22:37.803Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "payload", "vendor": "payloadcms", "versions": [{"status": "affected", "version": "< 3.75.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "4B2A5539-08DE-4938-BAE6-7E8CC7364C4F", "versionEndExcluding": "3.75.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at least one collection with `upload` enabled and a user who has `create` access to that upload-enabled collection in order to be vulnerable. An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application. This vulnerability has been patched in v3.75.0. As a workaround, one may mitigate this vulnerability by disabling external file uploads via the `disableExternalFile` upload collection option, or by restricting `create` access on upload-enabled collections to trusted users only."}, {"lang": "es", "value": "Payload es un sistema de gesti\u00f3n de contenido headless de c\u00f3digo abierto y gratuito. Antes de la versi\u00f3n 3.75.0, existe una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en la funcionalidad de carga de archivos externos de Payload. Al procesar URLs externas para la carga de archivos, una validaci\u00f3n insuficiente de las redirecciones HTTP podr\u00eda permitir a un atacante autenticado acceder a recursos de red internos. El entorno de Payload debe tener al menos una colecci\u00f3n con 'upload' habilitado y un usuario que tenga acceso de 'create' a esa colecci\u00f3n con carga habilitada para ser vulnerable. Un usuario autenticado con permisos de escritura en la colecci\u00f3n de carga podr\u00eda potencialmente acceder a servicios internos. El contenido de la respuesta de los servicios internos podr\u00eda recuperarse a trav\u00e9s de la aplicaci\u00f3n. Esta vulnerabilidad ha sido parcheada en la v3.75.0. Como soluci\u00f3n alternativa, se puede mitigar esta vulnerabilidad deshabilitando las cargas de archivos externos a trav\u00e9s de la opci\u00f3n de colecci\u00f3n de carga 'disableExternalFile', o restringiendo el acceso de 'create' en colecciones con carga habilitada solo a usuarios de confianza."}], "id": "CVE-2026-27567", "lastModified": "2026-06-17T10:27:19.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27567", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T19:03:18.715822Z", "version": "2.0.3"}}]}, "published": "2026-02-24T15:21:38.273", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/payloadcms/payload/commit/1041bb6"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/payloadcms/payload/releases/tag/v3.75.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-hhfx-5x8j-f5f6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.75.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "payload", "source": "cna", "vendor": "payloadcms"}, "product": "payload", "vendor": "payloadcms"}], "analysis": {"en": {"generated_at": "2026-04-16T16:26:58.518353+00:00", "value": {"mitigation_remediation": ["Upgrade Payload CMS to version 3.75.0 or later to apply the vendor\u2011issued fix.", "If an upgrade cannot be performed immediately, set the disableExternalFile option to true on all upload\u2011enabled collections to stop external URL processing.", "Otherwise limit create permissions on upload\u2011enabled collections to trusted or minimal\u2011privilege users."], "summary": {"action": "Apply Patch", "impact": "SSRF"}, "threat_synthesis": {"affected_systems": "Payload CMS versions prior to 3.75.0 are vulnerable. All installations of payloadcms:payload that have at least one collection with upload enabled and a user who can create uploads in that collection are affected.", "description_and_impact": "This CVE exposes a Server\u2011Side Request Forgery flaw in the external file upload feature of Payload CMS. The system fails to properly validate HTTP redirects when an external URL is supplied, allowing an authenticated attacker with write permission on an upload\u2011enabled collection to force the server to request arbitrary internal resources and retrieve their responses. The attacker could thus obtain data from internal services or platforms that should otherwise be unreachable from the public network.", "risk_and_exploitability": "The CVSS score is 6.5, indicating medium severity, while the EPSS probability is under 1%, signifying a relatively low likelihood of exploitation. The vulnerability is not listed in KEV. Exploitation requires an authenticated session and proper permissions on an upload\u2011enabled collection; once those conditions are met, the attacker can discover or read data from internal hosts via crafted redirects."}}}}, "created": "2026-02-25T11:39:01.187689+00:00", "updated": "2026-04-16T16:30:15.944969+00:00", "vendors": ["payloadcms", "payloadcms$PRODUCT$payload"]}