PT-2026-29596 · Pyload · Pyload

Highdenolfe · Published 2026-04-01 · Updated 2026-04-14 · CVE-2026-34748

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.78.0

Description Payload is a free and open source headless content management system. A stored Cross-Site Scripting (XSS) issue existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. The issue affects consumers if they are using a Payload version less than 3.78.0, have at least one collection with versions enabled, and an authenticated user has create or update access to that collection.

Recommendations Upgrade to version 3.78.0 or later. Restrict create and update access to versioned collections to trusted roles only.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34748

GHSA-MMXC-95CH-2J7C

Affected Products

Pyload

References · 9

• https://github.com/payloadcms/payload/security/advisories/GHSA-mmxc-95ch-2j7c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34748 · Security Note
• https://osv.dev/vulnerability/GHSA-mmxc-95ch-2j7c · Vendor Advisory
• https://github.com/payloadcms/payload · Note
• https://twitter.com/infoflowcloud/status/2039649967174742158 · Twitter Post
• https://twitter.com/CVEnew/status/2039647794466787579 · Twitter Post
• https://twitter.com/CveFindCom/status/2039670692006756585 · Twitter Post
• https://twitter.com/giuseppe_1337/status/2043846083764236444 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039583549830123962 · Twitter Post