CVE-2026-27567

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at least one collection with `upload` enabled and a user who has `create` access to that upload-enabled collection in order to be vulnerable. An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application. This vulnerability has been patched in v3.75.0. As a workaround, one may mitigate this vulnerability by disabling external file uploads via the `disableExternalFile` upload collection option, or by restricting `create` access on upload-enabled collections to trusted users only.

• CWE-918

• https://github.com/payloadcms/payload/commit/1041bb6Patch
• https://github.com/payloadcms/payload/releases/tag/v3.75.0Product, Release Notes
• https://github.com/payloadcms/payload/security/advisories/GHSA-hhfx-5x8j-f5f6Mitigation, Vendor Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27540Unrestricted Upload of File with Dangerous Type vulnerabilit…9
• CVE-2026-27541Incorrect Privilege Assignment vulnerability in Josh Kohlbac…7.2
• CVE-2026-27542Incorrect Privilege Assignment vulnerability in Rymera Web C…9.8
• CVE-2026-27545OpenClaw versions prior to 2026.2.26 contain an approval byp…4.7
• CVE-2026-2756A security vulnerability has been detected in OmniPEMF NeoRh…5
• CVE-2026-27566OpenClaw versions prior to 2026.2.22 contain an allowlist by…8.8
• CVE-2026-27568WWBN AVideo is an open source video platform. Prior to versi…6.1
• CVE-2026-2757Incorrect boundary conditions in the WebRTC: Audio/Video com…9.8
• CVE-2026-27570Discourse is an open-source discussion platform. Prior to ve…6.1
• CVE-2026-27571NATS-Server is a High-Performance server for NATS.io, a clou…7.5
• CVE-2026-27572Wasmtime is a runtime for WebAssembly. Prior to versions 24.…7.5
• CVE-2026-27573Rejected reason: Further research determined the situation d…