CVE-2026-34748

@payloadcms/next has Stored XSS in Admin Panel

At a glance

Severity: HIGH 8.7
EPSS: EPSS 0.29 % · percentile 21 (2026-10-27)
State: PUBLISHED
Published: 2026-04-01
Updated: 2026-04-02
Assigner: GitHub_M
NVD status: Analyzed

Description

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N	GitHub_M
CVSS 3.1	HIGH 8.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N	NVD · security-advisories@github.com (Secondary)

Weaknesses (CWE)

CWE-79

Advisories

GHSA-mmxc-95ch-2j7c — @payloadcms/next has Stored XSS in Admin Panel

European references

ENISA EUVD · EUVD-2026-18015
GCVE · GCVE-0-2026-34748

Affected configurations (NVD CPE)

cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* < 3.78.0

Affected products

Product	Versions
payloadcms · payload	affected < 3.78.0

References

https://github.com/payloadcms/payload/security/advisories/GHSA-mmxc-95ch-2j7c

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD