Payload CMS CVE-2026-105861

Exploitation requires that the Payload deployment uses the external-URL upload retrieval feature (server-side fetch of a user-supplied file URL). The attacker must control (or influence) a destination that issues an HTTP(S) redirect to an attacker-chosen origin, and an authenticated Payload user (PR:L) must actively trigger retrieval of that URL (UI:A). Only cookies whose names match the configured cookiePrefix (the Payload session cookies) are at risk, and only when forwarded onto a cross-origin redirect hop. Limiting factors that reduce real-world risk: a valid authenticated session is required, the upload-from-URL capability must be in use, user interaction is needed to initiate the fetch, and the attacker must control the redirect target; deployments that implement a restrictive externalFileHeaderFilter already mitigate cookie forwarding.

This is a genuine but conditional information-exposure flaw (CWE-200) rated CVSS 4.0 7.2 (High). The vendor vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H tells a consistent story: although network-reachable, exploitation requires a present attack requirement (AT:P - an attacker-controlled HTTP redirect), low-privilege authentication (PR:L - a logged-in Payload user), and active user interaction (UI:A - that user must initiate the external-URL upload). These three gating factors make the vulnerability targeted rather than mass-exploitable. No EPSS score was provided in the input, so exploitation probability cannot be quantified; the CVE is NOT in CISA KEV, and no POC is referenced - so there is no public exploit identified at time of analysis. The commit diff corroborates the description precisely: pre-patch, auth cookies matching the cookiePrefix were only trimmed when the URL started with 'http', and were re-attached across redirect hops without re-checking trust, which is the exact credential-forwarding behavior described. Net assessment: a real issue worth patching for any deployment that uses external-URL uploads, but not a drop-everything emergency given authentication, user-interaction, and attacker-redirect prerequisites; the VC:H/VI:H rating reflects that a leaked admin session can enable account takeover, not that the flaw is trivially reachable.

An attacker stands up a web server that responds to a file request with an HTTP 3xx redirect to an attacker-controlled origin. The attacker then induces an authenticated Payload user to initiate an external-URL file upload pointing at that server; because the code re-attaches the user's session cookies across the untrusted redirect, the valid session cookie is delivered to the attacker's domain, enabling session hijack and account takeover. No public proof-of-concept is referenced in the available data.