Payload CMS EUVD-2026-93514

Exploitation requires an upload collection configured to accept XML files (i.e., local upload configurations permitting XML/XML-family MIME types, such as via allowRestrictedFileTypes or XML in the accepted types) - default configurations that reject restricted file types are not affected. The attacker must hold an authenticated account with upload permission to that collection (PR:L), and a separate logged-in user must subsequently open the stored malicious file for the payload to fire (UI:P). Limiting factors: the dependence on a non-default XML-accepting configuration, the need for valid authenticated upload access, and required victim interaction all constrain realistic exploitation to environments that deliberately permit XML uploads and have multiple active users.

This is a credible-but-conditional threat rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) correctly signals that exploitation is network-reachable and low-complexity, but it also requires attacker privileges (PR:L - an authenticated account able to upload) and victim interaction (UI:P - a logged-in user must open the malicious file), which materially lowers real-world likelihood versus a true unauthenticated RCE. No EPSS score, KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active exploitation - treat the 8.6 as a severity ceiling, not a probability signal. The VC:H/VI:H/VA:H claim is partially questionable: this is effectively stored cross-site-scripting (JavaScript executing in the Payload admin origin via a stored XML file + stylesheet), which strongly supports confidentiality and integrity impact (session/token theft, actions as the victim), but a genuine availability (VA:H) impact is not substantiated by the description - verify with the vendor advisory. Net: prioritize patching for any deployment that permits XML uploads, but it ranks below internet-facing unauthenticated flaws.

An attacker with a low-privileged authenticated account on a Payload instance whose upload collection accepts XML files uploads a crafted XML document with an embedded stylesheet that carries JavaScript. When a logged-in administrator or other user later opens that stored file, the script executes in the Payload origin, allowing session/token theft or actions performed as the victim. No public exploit was identified at time of analysis, but the technique (XML/XSLT-driven script execution) is well understood and low-complexity.