PT-2026-6650 · Payloadcms · @Payloadcms/Db-D1-Sqlite+6

Thxtech

·

Published

2026-02-05

·

Updated

2026-03-18

·

CVE-2026-25544

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.73.0
Description Payload is a free and open source headless content management system. Prior to version 3.73.0, user input was directly embedded into SQL queries without proper escaping when querying JSON or richText fields, leading to blind SQL injection attacks. An unauthenticated attacker could potentially extract sensitive data, such as emails and password reset tokens, and gain full account takeover without needing to crack passwords. This issue affects users utilizing Drizzle-based database adapters (@payloadcms/drizzle dependency) – @payloadcms/db-postgres, @payloadcms/db-vercel-postgres, @payloadcms/db-sqlite, and @payloadcms/db-d1-sqlite – and having accessible collections with type: 'json' or type: 'richText' fields where access.read is not set to false. The vulnerability does not affect users utilizing @payloadcms/db-mongodb.
Recommendations Upgrade to Payload version 3.73.0 or later. If an immediate upgrade is not possible, add access: { read: () => false } to all JSON and richText fields as a temporary mitigation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-25544
GHSA-XX6W-JXG9-2WH8

Affected Products

@Payloadcms/Db-D1-Sqlite
@Payloadcms/Db-Mongodb
@Payloadcms/Db-Postgres
@Payloadcms/Db-Sqlite
@Payloadcms/Db-Vercel-Postgres
@Payloadcms/Drizzle
Pyload