CVE-2026-105844: Payload CMS RCE Vulnerability

CVE-2026-105844 Overview

CVE-2026-105844 affects Payload, an open source headless content management system. Unauthenticated attackers can submit prototype-sensitive field paths to the @payloadcms/plugin-import-export endpoint when that plugin is enabled. The malicious input triggers prototype pollution [CWE-1321], which can be chained into remote code execution against the host process. The flaw affects Payload versions from 3.0.0 before 3.88.0 and canary builds before 4.0.0-canary.27. Fixed releases are available in 3.88.0 and 4.0.0-canary.27.

Critical Impact
Unauthenticated remote attackers can pollute Object.prototype through the import-export plugin, enabling arbitrary code execution on the server.

Affected Products

Payload CMS versions 3.0.0 through 3.87.x
Payload CMS canary versions prior to 4.0.0-canary.27
Deployments with @payloadcms/plugin-import-export enabled

Discovery Timeline

2026-10-06 - CVE-2026-105844 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105844

Vulnerability Analysis

The vulnerability resides in the @payloadcms/plugin-import-export component. The plugin accepts user-controlled field path strings and uses them to assign values into nested JavaScript objects. Because the input is not filtered against prototype-sensitive keys such as __proto__, constructor, or prototype, an attacker can inject properties onto Object.prototype. Every object in the Node.js runtime then inherits the attacker-controlled properties, which can alter template rendering, authentication flow, or child process invocation. In Payload deployments that spawn worker processes or evaluate configuration-driven callbacks, polluted prototype properties translate into remote code execution.

Root Cause

The root cause is improperly controlled modification of object prototype attributes [CWE-1321]. The import-export plugin walks user-supplied dotted paths and recursively creates intermediate objects without validating that path segments are safe property names. The absence of an allowlist on field paths lets attackers reach the prototype chain.

Attack Vector

Exploitation requires no authentication and only network access to a Payload instance that enables the import-export plugin. The attacker submits a crafted import payload containing field path segments that reference __proto__ or constructor.prototype. Once prototype pollution succeeds, subsequent server-side logic that reads the polluted property can be coerced into executing attacker-controlled code.

The published patch is referenced in the GitHub Security Advisory GHSA-qf28-8hc6-vwrp and commit a742140. Illustrative snippets from the fix show hardened redirect handling in example auth flows updated alongside the plugin fix:

text

 import Link from 'next/link'
 import { useRouter, useSearchParams } from 'next/navigation'
+import { getSafeRedirect } from 'payload/shared'
 import React, { useCallback, useRef, useState } from 'react'
 import { useForm } from 'react-hook-form'

Source: payloadcms/payload commit a742140

Detection Methods for CVE-2026-105844

Indicators of Compromise

HTTP requests to import-export plugin endpoints containing __proto__, constructor, or prototype tokens in JSON bodies or query strings.
Unexpected Node.js child processes spawned by the Payload runtime shortly after import or export API calls.
Server logs showing anonymous POST requests to import-export routes from unfamiliar source addresses.

Detection Strategies

Inspect reverse proxy and application logs for request bodies that include prototype-sensitive keys targeting /api/*import* or /api/*export* paths.
Enable runtime instrumentation that alerts when Object.prototype acquires new enumerable properties during request handling.
Correlate anonymous requests to the import-export plugin with subsequent process execution events on the same host.

Monitoring Recommendations

Forward Payload application logs and Node.js process telemetry to a centralized analytics platform for anomaly review.
Alert on new outbound network connections initiated by the Payload process immediately after import-export API calls.
Track the installed version of payload and @payloadcms/plugin-import-export across environments to confirm patch coverage.

How to Mitigate CVE-2026-105844

Immediate Actions Required

Upgrade Payload to version 3.88.0 or 4.0.0-canary.27 or later as published in the v3.88.0 release notes.
If immediate upgrade is not possible, disable @payloadcms/plugin-import-export in your Payload configuration.
Restrict network access to the Payload admin and API routes to trusted operators until patching completes.

Patch Information

The fix is published in Payload 3.88.0 and canary 4.0.0-canary.27. Review the GitHub Security Advisory GHSA-qf28-8hc6-vwrp and the remediation commit a742140 for exact code changes.

Workarounds

Remove or comment out the importExportPlugin entry from the plugins array in payload.config.ts until the upgrade is deployed.
Place a reverse proxy rule that rejects requests to import-export endpoints containing __proto__, constructor, or prototype substrings.
Require authenticated sessions in front of all /api routes using an upstream gateway or WAF policy.

bash

# Upgrade Payload and the import-export plugin to patched versions
npm install payload@3.88.0 @payloadcms/plugin-import-export@latest

# Verify installed versions
npm ls payload @payloadcms/plugin-import-export