Payload Form Builder plugin: Remote Code Execution via form submission
Summary
The form-builder plugin (@payloadcms/plugin-form-builder) of the open source headless CMS Payload contains a flaw that allows code injection through crafted form submissions. A remote attacker can execute code on the server without logging in and without user interaction, which can lead to full compromise of confidentiality, integrity and availability. Any site that uses the plugin on the affected versions is exposed, because form endpoints are public by design.
Affected
- @payloadcms/plugin-form-builder before 3.90.0
- Canary versions from 4.0.0-canary.0 before 4.0.0-canary.34
- Unknown: the earliest affected version, as one third-party database conflicts with the vendor range.
Fixed in
- 3.90.0 or later (3.x)
- 4.0.0-canary.34 or later (canary)
- Recommended: the latest patched 3.x release.
Workaround
Unknown. The vendor does not list a workaround. Third-party sources suggest disabling the form builder or restricting form endpoints to trusted sources. These are unverified stop-gap measures only, and disabling access control is not a mitigation.
Exploitation
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- No confirmed in-the-wild exploitation known at the time of research.
- No verified public proof of concept known.
- The attack needs no login, so attackers may scan for it quickly.
Our recommendation
- Inventory all projects and lockfiles for @payloadcms/plugin-form-builder and other @payloadcms/* packages.
- Upgrade to 3.90.0 at minimum, preferably the latest patched 3.x release, then redeploy.
- If the plugin was exposed before patching, review web server and application logs for unusual POST requests to form endpoints.
- If there is evidence of compromise, treat the host as compromised and rotate secrets, environment variables and database credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r488-j9vj-wx3q github.com
- Fix commit 333b82b (restrict form data access) github.com
- Payload release v3.90.0 github.com
- OSV entry GHSA-r488-j9vj-wx3q osv.dev
- OpenCVE CVE-2026-105857 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:36.
Original description (NVD)
Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.