CVE-2026-105858 | Payload CMS up to 3.89.x/4.0.0-canary.33 Registration first-register code injection

October 6, 2026 Yanac

A vulnerability was found in Payload CMS Payload up to 3.89.x/4.0.0-canary.33 and classified as critical. Affected by this vulnerability is the function first-register of the component Registration. The manipulation results in code injection.

This vulnerability was named CVE-2026-105858. The attack may be performed from remote. There is no available exploit.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More