What is the CVSS score of CVE-2026-25544?

CVE-2026-25544 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Payload are affected by CVE-2026-25544?

A critical SQL injection vulnerability in Payload CMS versions prior to 3.73.0 allows unauthenticated attackers to extract sensitive data from affected systems with a CVSS score of 9.8.. A patch is available.

How to fix or mitigate CVE-2026-25544?

Within 24 hours: Identify all systems running Payload CMS and document versions; immediately isolate affected instances from production if critical data is at risk. Within 7 days: Implement network-level controls and WAF rules to block SQL injection patterns; contact Payload project for patch timeline and workarounds. Within 30 days: Either upgrade to Payload 3.73.0 or later when available, or execute comprehensive incident response plan including threat hunting for evidence of exploitation.

Payload CVE-2026-25544

CRITICAL

SQL Injection (CWE-89)

2026-02-06 security-advisories@github.com

GHSA-xx6w-jxg9-2wh8

SQLi Payload

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 06, 2026 - 22:16 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on @payloadcms/drizzle (4 direct, 1 indirect)

Ecosystem-wide dependent count for version 3.73.0.

DescriptionGitHub Advisory

Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.