CVE-2026-105857: Payload CMS Form Builder RCE Vulnerability

CVE-2026-105857 Overview

CVE-2026-105857 is a remote code execution vulnerability in the Payload CMS @payloadcms/plugin-form-builder plugin. Payload is a free and open source headless content management system written in TypeScript. An attacker can craft a form submission that triggers code execution on the server without authentication. The flaw affects @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34. Maintainers released fixed versions 3.90.0 and 4.0.0-canary.34 that restrict access to form submission data. The weakness is categorized under [CWE-94] Improper Control of Generation of Code.

Critical Impact

Unauthenticated remote attackers can execute arbitrary code on servers running vulnerable versions of the Payload form builder plugin, leading to full server compromise.

Affected Products

• Payload CMS @payloadcms/plugin-form-builder versions prior to 3.90.0
• Payload CMS @payloadcms/plugin-form-builder canary versions prior to 4.0.0-canary.34
• Any Payload CMS deployment that installs the form builder plugin

Discovery Timeline

• 2026-10-06 - CVE-2026-105857 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105857

Vulnerability Analysis

The vulnerability resides in the form submission handling logic of the Payload form builder plugin. The plugin exposes form submission and form configuration data to any authenticated user through an overly permissive access control rule. Combined with the way submitted form data is processed server-side, an attacker can craft a submission payload that is interpreted and executed as code on the backend. The result is unauthenticated remote code execution with the privileges of the Payload server process. Successful exploitation gives an attacker a foothold to read secrets, pivot to databases, or deploy additional payloads.

Root Cause

The root cause is improper access control on the form-submissions collection and on the emails field of the Forms collection. The original access function returned true for any logged-in user with read: ({ req: { user } }) => !!user. This allowed non-admin accounts, including self-registered users on public instances, to read form configuration and submission content that was intended to remain internal. That exposed data drives downstream processing where attacker-controlled values are evaluated, resulting in code execution [CWE-94].

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker submits a crafted form to the public form endpoint exposed by the plugin. The submitted content is processed by the server-side form handler, which executes the embedded instructions. Because the access scope extends beyond admin users, the attacker does not need administrative credentials to influence the vulnerable code path.

// Security patch in packages/plugin-form-builder/src/collections/FormSubmissions/index.ts
     slug: formConfig?.formSubmissionOverrides?.slug || 'form-submissions',
     access: {
       create: () => true,
-      read: ({ req: { user } }) => !!user, // logged-in users,
+      read: ({ req }) => req.user?.collection === req.payload.config.admin.user,
       update: () => false,
       ...(formConfig?.formSubmissionOverrides?.access || {}),
     },

Source: GitHub Commit 333b82b

The fix narrows the read access check so only users belonging to the configured admin collection can read form submissions and the emails configuration array.

Detection Methods for CVE-2026-105857

Indicators of Compromise

• Unexpected outbound network connections from the Node.js process hosting Payload CMS, especially to attacker-controlled IPs following form submissions.
• Anomalous child processes spawned by the Payload server such as sh, bash, curl, wget, or node -e invocations.
• Non-admin user accounts issuing authenticated GET requests to /api/form-submissions or reading the emails field of /api/forms.
• Form submission payloads containing template-like syntax, serialized objects, or unusually long string fields.

Detection Strategies

• Inspect application logs for POST requests to the form submission endpoint followed closely by process creation or outbound socket events on the host.
• Compare the installed version of @payloadcms/plugin-form-builder in package-lock.json or pnpm-lock.yaml against the fixed versions 3.90.0 and 4.0.0-canary.34.
• Enable runtime behavioral monitoring on the Node.js process to flag unexpected shell execution, file writes to web roots, or crypto-mining binaries.

Monitoring Recommendations

• Forward web server, reverse proxy, and application logs to a centralized analytics pipeline and alert on repeated anomalous form submission payloads.
• Monitor process lineage on the server, treating any shell or scripting interpreter spawned by the Node.js runtime as high-priority telemetry.
• Track read operations against the form-submissions collection by non-admin principals and alert on access from unexpected service accounts.

How to Mitigate CVE-2026-105857

Immediate Actions Required

• Upgrade @payloadcms/plugin-form-builder to version 3.90.0, or to canary 4.0.0-canary.34 for projects tracking the 4.x branch.
• Audit existing form submissions for suspicious entries and review server logs for signs of exploitation prior to upgrade.
• Rotate any secrets, API tokens, or credentials that were accessible from the Payload server process.
• Review and restrict user registration on public Payload instances until the patched version is deployed.

Patch Information

The fix is published in the official GitHub Security Advisory GHSA-r488-j9vj-wx3q and in the GitHub Release v3.90.0. The patch commit 333b82b narrows the read access functions on the form-submissions collection and the emails field of the Forms collection so that only users from the configured admin collection may read these resources.

Workarounds

• If immediate upgrade is not possible, override the plugin configuration to replace the formSubmissionOverrides.access.read function with one that restricts reads to the admin user collection.
• Place the Payload admin and API endpoints behind network-level access controls or an authenticated reverse proxy to limit exposure from the public internet.
• Disable the form builder plugin entirely in environments where it is not actively used.

# Upgrade the vulnerable plugin to a fixed version
npm install @payloadcms/plugin-form-builder@3.90.0

# Or, for projects on the 4.x canary line
npm install @payloadcms/plugin-form-builder@4.0.0-canary.34

# Verify the installed version
npm ls @payloadcms/plugin-form-builder