Vulnerability in Payload CMS software
Vulnerability in Payload CMS software
| CVE ID | CVE-2026-63316 |
| Publication date | 13 October 2026 |
| Vendor | Payload |
| Product | Payload CMS |
| Vulnerable versions | All before 3.90.0 From 4.0.0-canary.0 to 4.0.0-canary.34 |
| Vulnerability type (CWE) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
| Report source | Report to CERT Polska |
Description
CERT Polska has received a report about vulnerability in Payload CMS software and participated in coordination of its disclosure.
The vulnerability CVE-2026-63316: A SQL Injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by a user into in and not_in query parameters allows an authenticated attacker to perform SQL Injection attacks.
This issue was fixed in version 3.90.0 and 4.0.0-canary.34.
Credits
We thank 0xMesbaha for the responsible vulnerability report.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.