Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

The impact of CVE-2026-25544 is severe due to the ease of exploitation and the potential for complete account takeover. An attacker can leverage this vulnerability to bypass authentication and directly query the database, extracting sensitive information. Specifically, the vulnerability allows attackers to retrieve emails and password reset tokens, which can then be used to gain unauthorized access to user accounts without needing to crack passwords. This represents a significant data breach risk and could lead to further compromise of the system and its data. The lack of authentication required for exploitation significantly broadens the attack surface.

Organizations using Payload CMS for headless content management, particularly those relying on JSON or richText fields for content storage, are at significant risk. Shared hosting environments where multiple Payload CMS instances share a database are especially vulnerable, as a compromise of one instance could potentially expose data from others. Legacy configurations with outdated security practices are also at increased risk.

• nodejs: Monitor Payload CMS application logs for SQL injection attempts targeting JSON or richText fields. Look for unusual SQL queries containing user-supplied input.

grep -i 'payload cms' /var/log/nginx/error.log | grep -i 'sql injection'

• generic web: Use curl to test vulnerable endpoints with SQL injection payloads. Examine the response for error messages or unexpected data.

curl -X POST -d "payload='; DROP TABLE users; --" https://your-payload-cms-site/api/endpoint

• database (mysql): Monitor MySQL logs for unusual SQL queries originating from the Payload CMS application. Look for queries containing user-supplied input without proper escaping.

SELECT * FROM mysql.general_log WHERE command_type = 'Query' AND user = 'payload_cms_user';

1. 2026-02-06Disclosure

   disclosure

1. 已保留2026-02-02
2. 发布日期2026-02-06
3. 修改日期2026-02-09
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-25544 is to immediately upgrade Payload CMS to version 3.73.0 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to filter SQL injection attempts targeting JSON and richText fields. Carefully review and sanitize all user inputs before incorporating them into SQL queries. Monitor database logs for suspicious SQL queries that might indicate an ongoing attack. After upgrading, confirm the fix by attempting a SQL injection attack on the affected endpoints and verifying that the input is properly sanitized.