SQL Injection Vulnerability in Payload CMS by Payload
CVE-2026-63316

8.7HIGH

Key Information:

Vendor

Payload

Status
Payload Cms
Vendor
CVE Published:
13 October 2026

What is CVE-2026-63316?

A SQL injection vulnerability exists in Payload CMS due to improper handling of user inputs in 'in' and 'not_in' query parameters. This flaw can be exploited by authenticated attackers, enabling them to execute malicious SQL statements that can compromise the database and leak sensitive information. Users are advised to upgrade to Payload CMS version 3.90.0 or 4.0.0-canary.34 to mitigate the risks associated with this vulnerability.

Affected Version(s)

Payload CMS 0 < 3.90.0

Payload CMS 4.0.0-canary.0 < 4.0.0-canary.34

References

https://cert.pl/posts/2026/10/CVE-2026-63316
third-party-advisory
https://github.com/payloadcms/payload/security/advisories...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0xMesbaha
.