DailyCVE@dailycve
🔴 Payload, Client uploads S3 Object Overwrite, #CVE-2026-105867 (High) -DC-Oct2026-2852 https://dailycve.com/payload-client-uploads-s3-object-overwrite-cve-2026-105867-high-dc-oct2026-2852/
0000018
239 followersView on X
CVE-2026-105867
LOWCVSS 7.1 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-639
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day