Payload CMS CVE-2026-105862

Exploitation requires a collection explicitly configured to allow downloadable SVG uploads (per the description), an attacker holding an authenticated account with upload privileges to that collection (CVSS PR:L), and a victim who subsequently downloads AND opens the stored SVG (CVSS UI:R) in a context where the embedded JavaScript executes. Limiting factors: it does not work against deployments that disallow SVG/XML uploads, it needs valid authenticated upload access rather than anonymous access, and it depends on victim action - a non-default upload configuration plus user interaction substantially narrow the realistic attack surface below what the 8.7 base score alone implies.

This is a stored cross-site scripting flaw (CWE-79) in Payload CMS with a vendor-provided CVSS 3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N (8.7, High). The signals are moderate rather than extreme: AV:N and AC:L favor the attacker, but PR:L means the attacker must already hold a valid account with upload rights, and UI:R means a victim must download AND open the malicious SVG - both meaningfully constrain weaponization. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so the exploitation status is 'no public exploit identified at time of analysis.' The S:C (scope change) plus C:H/I:H reflects that attacker JavaScript executes in the victim's authenticated browser context, which in an admin CMS could escalate to account/session takeover - that is why the score lands high despite the interaction requirement. Net: this is a legitimate issue to patch for anyone running collections that accept SVG uploads, but it is not a drop-everything internet-wide emergency - it requires both an authenticated uploader and victim action, pointing to targeted/insider abuse rather than mass exploitation. The source-code diff (adding sax-based XML parsing, CSP headers for XML-family MIME types, and server-side upload validation) independently confirms the root cause is incomplete SVG/XML sanitization, corroborating the description.

An attacker with a low-privileged account that can upload to a collection permitting downloadable SVGs stores an SVG containing embedded JavaScript that evades Payload's sanitization. When an administrator or another user later downloads and opens that SVG, the attacker's script executes in their browser context, enabling session/credential theft or actions on their behalf. No public exploit code is referenced, so exploitation would require an attacker to craft the bypass independently.