VYPR
Get started
← All advisories
Medium severity6.5NVD Advisory· Published Apr 1, 2026· Updated Apr 13, 2026

CVE-2026-34750

CVE-2026-34750

Description

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been patched in version 3.78.0 for @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@payloadcms/storage-azurenpm
< 3.78.03.78.0
@payloadcms/storage-gcsnpm
< 3.78.03.78.0
@payloadcms/storage-r2npm
< 3.78.03.78.0
@payloadcms/storage-s3npm
< 3.78.03.78.0

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

50