CVE-2026-105862 | Payload CMS up to 3.89.x/4.0.0-canary.33 SVG Upload cross site scripting

October 6, 2026 Yanac

A vulnerability marked as problematic has been reported in Payload CMS Payload up to 3.89.x/4.0.0-canary.33. This issue affects some unknown processing of the component SVG Upload. The manipulation leads to cross site scripting.

This vulnerability is documented as CVE-2026-105862. The attack can be initiated remotely. There is not any exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More