Db Postgres
Monthly
Authenticated SQL injection in Payload CMS allows a user holding read plus create or update permission on a collection that contains a json field - or a blocks field with blocksAsJSON enabled - to inject arbitrary SQL through crafted field paths and query operators when the site runs on the Postgres or SQLite database adapters. Only collections carrying those specific field types are reachable; collections built purely from text and richText fields are explicitly not affected, and richText fields themselves are not exploitable. The flaw requires an authenticated principal (CVSS PR:L) with write access, which materially narrows the attack surface, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; Payload has shipped fixes in 3.90.0 (SQLite adapters), 3.73.0 (Postgres adapters) and 4.0.0-canary.34.
Authenticated SQL injection in Payload CMS allows a user holding read plus create or update permission on a collection that contains a json field - or a blocks field with blocksAsJSON enabled - to inject arbitrary SQL through crafted field paths and query operators when the site runs on the Postgres or SQLite database adapters. Only collections carrying those specific field types are reachable; collections built purely from text and richText fields are explicitly not affected, and richText fields themselves are not exploitable. The flaw requires an authenticated principal (CVSS PR:L) with write access, which materially narrows the attack surface, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; Payload has shipped fixes in 3.90.0 (SQLite adapters), 3.73.0 (Postgres adapters) and 4.0.0-canary.34.