payloadcms/payload · Security
Payload: Remote Code Execution through first-register
- GHSA ID
- GHSA-97rh-rhh2-7vjv
- CVE ID
- CVE-2026-105858
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Impact
A crafted request to the public first-register operation can be used to perform a RCE exploit.
You are affected if:
- You use local auth strategy and your application remains without an initial user created
Patches
In the patched version data submission to create first user is properly sanitized.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References
- https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-105858 ↗
- https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679 ↗
- https://github.com/payloadcms/payload/releases/tag/v3.90.0 ↗
- https://github.com/advisories/GHSA-97rh-rhh2-7vjv ↗