Payload Import Export plugin: Prototype pollution enabling remote code execution

Summary

The Import Export plugin of the Payload headless CMS allows unauthenticated users to submit prototype-sensitive field paths. This can cause unintended application behavior that may lead to remote code execution. Only sites with the plugin enabled are affected, and the CVSS 4.0 base score is 9.3 (critical).

Affected

• @payloadcms/plugin-import-export and payload 3.0.0 up to (excluding) 3.88.0
• @payloadcms/plugin-import-export and payload 4.0.0-canary.0 up to (excluding) 4.0.0-canary.27
• Applications without the Import Export plugin are not affected.

Fixed in

• 3.88.0
• 4.0.0-canary.27

Workaround

• Disable the Import Export plugin.
• Restrict access to the plugin's endpoints at the reverse proxy until the update is installed.

Exploitation

• A public proof-of-concept exists; its author describes the impact as potential, application-dependent RCE. The code was not verified.
• No confirmed in-the-wild exploitation was found.
• The CVE is not listed in CISA KEV as far as checked.
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Check package.json and the lockfile for all @payloadcms/* packages and for the Import Export plugin.
• Upgrade all @payloadcms/* packages together to 3.88.0 or 4.0.0-canary.27 or later, and verify that the lockfile has no duplicate versions.
• If patching is not immediate, disable the plugin or restrict its endpoints.
• Review logs since 6 Oct 2026 for unusual requests to export and import functions.
• Prioritise internet-facing Payload sites that use the plugin.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  murrez/CVE-2026-105844

Research sources

• GitHub Security Advisory GHSA-qf28-8hc6-vwrp (Payload) github.com
• Payload fix commit a742140 github.com
• Payload release v3.88.0 github.com
• GitHub Advisory Database GHSA-qf28-8hc6-vwrp github.com
• OSV GHSA-qf28-8hc6-vwrp osv.dev
• Public proof-of-concept repository (murrez/CVE-2026-105844) github.com
• Hol.org CVE summary hol.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:16.