CVE-2026-34750: Payload CMS Path Traversal Vulnerability

CVE-2026-34750 Overview

CVE-2026-34750 is a path traversal vulnerability affecting PayloadCMS, a free and open source headless content management system. Prior to version 3.78.0, the client-upload signed-URL endpoints for cloud storage plugins including @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3 did not properly sanitize filenames. An attacker could craft malicious filenames to escape the intended storage location, potentially overwriting existing files or storing content in unauthorized directories.

Critical Impact

Authenticated attackers can exploit insufficient filename sanitization to write files outside intended storage paths, potentially leading to unauthorized data access, file overwrites, or system compromise depending on storage configuration.

Affected Products

• @payloadcms/storage-azure prior to version 3.78.0
• @payloadcms/storage-gcs prior to version 3.78.0
• @payloadcms/storage-r2 prior to version 3.78.0
• @payloadcms/storage-s3 prior to version 3.78.0

Discovery Timeline

• 2026-04-01 - CVE-2026-34750 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34750

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The flaw exists in how the PayloadCMS cloud storage plugins handle user-supplied filenames when generating signed URLs for client-side uploads.

When users upload files through PayloadCMS, the storage plugins create pre-signed URLs that allow direct uploads to cloud storage backends (AWS S3, Google Cloud Storage, Azure Blob Storage, and Cloudflare R2). The filename parameter passed to these endpoints was not properly validated or sanitized, allowing directory traversal sequences to be included.

The vulnerability requires authentication (low privileges) but can be exploited remotely over the network without user interaction. Successful exploitation impacts the integrity of the storage system by allowing unauthorized file placement, though it does not directly enable data exfiltration or service disruption.

Root Cause

The root cause is improper input validation in the signed-URL generation endpoints. The affected code paths accepted filenames directly from user input and incorporated them into storage paths without stripping or rejecting path traversal sequences such as ../ or URL-encoded variants like %2e%2e%2f. This allowed attackers to construct filenames that, when processed by the cloud storage backend, would resolve to locations outside the designated upload directory.

Attack Vector

The attack is network-based and requires an authenticated user with upload permissions. An attacker can exploit this vulnerability by:

1. Authenticating to a PayloadCMS instance with file upload capabilities
2. Initiating a file upload request through the client-upload endpoint
3. Supplying a maliciously crafted filename containing path traversal sequences (e.g., ../../../malicious.txt)
4. The storage plugin generates a signed URL without sanitizing the filename
5. The file is uploaded to an unintended location in the cloud storage bucket

The vulnerability allows file writes to arbitrary paths within the cloud storage account that the service has access to, potentially overwriting configuration files, application assets, or other sensitive data depending on the storage structure and permissions.

Detection Methods for CVE-2026-34750

Indicators of Compromise

• Presence of files in unexpected cloud storage locations outside designated upload directories
• Upload request logs containing path traversal sequences (../, ..%2f, %2e%2e/) in filename parameters
• Files with suspicious names or in system directories within the storage bucket
• Unusual access patterns to storage resources that should not be modified by uploads

Detection Strategies

• Implement cloud storage logging (AWS CloudTrail, GCP Audit Logs, Azure Monitor) to track object creation events
• Monitor for PUT requests containing encoded or literal path traversal patterns in object keys
• Deploy web application firewall (WAF) rules to detect and block traversal sequences in upload endpoints
• Review PayloadCMS application logs for upload requests with malformed or suspicious filenames

Monitoring Recommendations

• Enable detailed request logging on PayloadCMS upload endpoints
• Set up alerts for file creation events outside expected bucket prefixes in cloud storage
• Implement bucket inventory reports to detect unauthorized objects
• Conduct regular audits of storage bucket contents against expected file structures

How to Mitigate CVE-2026-34750

Immediate Actions Required

• Upgrade all affected storage plugins to version 3.78.0 or later immediately
• Audit existing cloud storage buckets for files that may have been written to unexpected locations
• Review access logs for evidence of exploitation attempts
• Temporarily disable client-side uploads if immediate patching is not possible

Patch Information

The vulnerability has been patched in version 3.78.0 of the affected packages. Update your dependencies by running the appropriate package manager commands for your project:

For npm-based projects, update the storage plugins to the patched version. The fix implements proper filename sanitization to prevent path traversal sequences from being included in storage paths. Review the GitHub Security Advisory for complete details on the remediation.

Workarounds

• Implement application-level filename validation that strips or rejects path traversal sequences before passing to storage plugins
• Configure cloud storage bucket policies to restrict write access to specific path prefixes only
• Use storage-level access controls to limit the directories where the application service account can write
• Deploy a reverse proxy or WAF rule to sanitize upload request parameters before they reach PayloadCMS

# Update PayloadCMS storage plugins to patched version
npm update @payloadcms/storage-s3@3.78.0
npm update @payloadcms/storage-gcs@3.78.0
npm update @payloadcms/storage-azure@3.78.0
npm update @payloadcms/storage-r2@3.78.0