Skip to content
OpenAdvisories
Critical · 9.3 Public exploit CVE-2026-105844 EUVD-2026-93470GHSA-qf28-8hc6-vwrp

Payload: Prototype pollution in Payload Import Export plugin

Published Oct 6, 2026 · Updated Oct 9, 2026 · Assigned by GitHub_M

Vendor: Payload CMS Product: payload Product: plugin-import-export Package: @payloadcms/plugin-import-export Ecosystem: npm

Description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Affected products

VendorProductAffectedFixed
payloadcms payload >= 3.0.0, < 3.88.0, >= 4.0.0-canary.0, < 4.0.0-canary.27 —
@payloadcms plugin-import-export >= 3.0.0, < 3.88.0, >= 4.0.0-canary.0, < 4.0.0-canary.27 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • murrez/CVE-2026-105844 ★ 1 · Oct 7, 2026

    CVE-2026-105844 — Payload CMS @payloadcms/plugin-import-export <3.88.0 unauth prototype pollution (CWE-1321, CVSS 4.0 9.3). PoCbit PoC: POST /api/exports/export-preview fields __proto__.overrideAcces…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm @payloadcms/plugin-import-export >= 3.0.0, < 3.88.0 3.88.0 GHSA-qf28-8hc6-vwrp
npm @payloadcms/plugin-import-export >= 4.0.0-canary.0, < 4.0.0-canary.27 4.0.0-canary.27 GHSA-qf28-8hc6-vwrp

References