Storage S3
Monthly
An authenticated user of Payload CMS can overwrite an existing S3 object owned by a different upload collection when the @payloadcms/storage-s3 plugin is used with client uploads enabled across multiple collections that share a single bucket and leave useCompositePrefixes at its default (false or unset). Because the signed-URL generation path did not bind the target object key to the requesting collection, the attacker's upload silently replaces the victim collection's stored file, bypassing that collection's access controls and any prior file-type/size validation. The flaw yields high integrity impact with no confidentiality loss (CVSS 7.1), requires an authenticated session (PR:L) plus the specific shared-bucket client-upload configuration, and no public exploit code or CISA KEV entry was identified at time of analysis.
An authenticated user of Payload CMS can overwrite an existing S3 object owned by a different upload collection when the @payloadcms/storage-s3 plugin is used with client uploads enabled across multiple collections that share a single bucket and leave useCompositePrefixes at its default (false or unset). Because the signed-URL generation path did not bind the target object key to the requesting collection, the attacker's upload silently replaces the victim collection's stored file, bypassing that collection's access controls and any prior file-type/size validation. The flaw yields high integrity impact with no confidentiality loss (CVSS 7.1), requires an authenticated session (PR:L) plus the specific shared-bucket client-upload configuration, and no public exploit code or CISA KEV entry was identified at time of analysis.