CVE-2026-25544 PUBLISHED

Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

Assigner: GitHub_M
Reserved: 02.02.2026 Published: 06.02.2026 Updated: 06.02.2026

Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor payloadcms
Product payload
Versions
  • Version < 3.73.0 is affected

References

Problem Types

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE