CVE-2026-105865

{
  "etk_id": "ETK-2026-923",
  "cve_id": "CVE-2026-105865",
  "display_id": "CVE-2026-105865",
  "ghsa_id": "GHSA-p223-2wr2-j562",
  "euvd_id": "EUVD-2026-93511",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper path validation in Payload upload cleanup",
  "summary": "Payload deployments using locally stored upload collections are affected before the patched releases. An authenticated user allowed to update or delete uploads can cause cleanup to remove files beyond the intended upload directory, potentially causing data loss or service disruption.",
  "mitigation": "Upgrade the npm `payload` package to 3.90.0 or later, or to 4.0.0-canary.34 or later on the canary line. Until upgraded, limit upload update and deletion permissions to trusted users and validate submitted filenames.",
  "vendor": "npm",
  "product": "payload",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 3.90.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.90.0"
      ],
      "package_name": "payload",
      "purl": "pkg:npm/payload"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0-canary.0, < 4.0.0-canary.34"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "4.0.0-canary.34"
      ],
      "package_name": "payload",
      "purl": "pkg:npm/payload"
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": 0.0038,
  "epss_percentile": 0.3059,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.158805483333333,
  "t0_at": "2026-10-06T16:45:09.932000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-06T16:45:09.932000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T16:45:09.932000+00:00",
      "url": "https://github.com/advisories/GHSA-p223-2wr2-j562"
    }
  }
}