PT-2026-29595 · Pyload · Pyload

Arkmarta + 1 · CVE-2026-34747 · Published 2026-04-01 · Updated 2026-04-02

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.79.1

Description Payload, a headless content management system, had insufficient input validation in certain requests. This allowed attackers to manipulate SQL query execution, potentially leading to data exposure or modification in collections.

Recommendations Upgrade to version 3.79.1 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-34747

GHSA-7XXH-373W-35VG

Affected Products

Pyload

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34747.json · Exploit
• https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34747 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34747 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7xxh-373w-35vg · Vendor Advisory
• https://github.com/payloadcms/payload · Note
• https://github.com/payloadcms/payload/releases/tag/v3.79.1 · Note
• https://twitter.com/infoflowcloud/status/2039746472657256713 · Twitter Post
• https://twitter.com/CVEnew/status/2039744373949088066 · Twitter Post
• https://twitter.com/CveFindCom/status/2039670671706398998 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039588823840260378 · Twitter Post