Medium severity6.5NVD Advisory· Published Apr 1, 2026· Updated Apr 13, 2026
CVE-2026-34750
CVE-2026-34750
Description
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@payloadcms/storage-azurenpm | < 3.78.0 | 3.78.0 |
@payloadcms/storage-gcsnpm | < 3.78.0 | 3.78.0 |
@payloadcms/storage-r2npm | < 3.78.0 | 3.78.0 |
@payloadcms/storage-s3npm | < 3.78.0 | 3.78.0 |
Affected products
5- ghsa-coords4 versionspkg:npm/%40payloadcms/storage-azurepkg:npm/%40payloadcms/storage-gcspkg:npm/%40payloadcms/storage-r2pkg:npm/%40payloadcms/storage-s3
< 3.78.0+ 3 more
- (no CPE)range: < 3.78.0
- (no CPE)range: < 3.78.0
- (no CPE)range: < 3.78.0
- (no CPE)range: < 3.78.0
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-frq9-7j6g-v74xghsaADVISORY
- github.com/payloadcms/payload/security/advisories/GHSA-frq9-7j6g-v74xnvdVendor AdvisoryMitigationWEB
- nvd.nist.gov/vuln/detail/CVE-2026-34750ghsaADVISORY
News mentions
0No linked articles in our index yet.