CVE-2026-105856 | PayloadCMS Payload db-d1-sqlite field path/operators sql injection

October 6, 2026 Yanac

A vulnerability labeled as critical has been found in PayloadCMS Payload. This vulnerability affects unknown code of the component db-d1-sqlite/db-postgres/db-sqlite/db-vercel-postgres. Executing a manipulation of the argument field path/operators can lead to sql injection.

This vulnerability is registered as CVE-2026-105856. It is possible to launch the attack remotely. No exploit is available.VulDB Recent EntriesRead More