Payload CMS: SQL injection via in and not_in query parameters
Summary
Payload CMS, a headless content management system, contains an SQL injection vulnerability in the handling of the "in" and "not_in" query parameters. An authenticated attacker can inject SQL commands, which may expose or modify database content. According to the vendor advisory, exploitation requires read plus create or update access to a collection that has a json field or a blocks field with blocksAsJSON enabled.
Affected
- Payload CMS below 3.90.0
- Payload CMS 4.0.0-canary.0 to below 4.0.0-canary.34
- Vendor advisory lists @payloadcms/db-postgres and @payloadcms/db-vercel-postgres below 3.73.0 as affected, which conflicts with the CVE range; treat as unresolved
Fixed in
- Payload CMS 3.90.0
- Payload CMS 4.0.0-canary.34
- Upgrade to 3.90.0 for all installations, including Postgres
Workaround
Unknown. No workaround is documented by the vendor or CERT Polska. Interim measure (not from a source): restrict and review accounts with create or update rights on collections.
Exploitation
- Known exploited: no (per available sources)
- Public exploit or PoC: none found; VulDB reports no available exploit
- EPSS: 0.00259 (low likelihood of exploitation in the next 30 days)
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Inventory all Payload packages (npm ls payload and all @payloadcms/* packages) in every project.
- Upgrade to 3.90.0 or 4.0.0-canary.34 or later on the relevant release line and check release notes for breaking changes.
- Review which accounts can create or update collection data and restrict them to necessary users.
- Prioritise internet-facing sites with editor or user accounts that have write access.
- Ask CERT Polska or the vendor to confirm the Postgres fix version and the overlap with CVE-2026-105856.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory CVE-2026-63316 cert.pl
- GitHub Security Advisory GHSA-pj7x-6wpf-pgvp github.com
- OSV GHSA-pj7x-6wpf-pgvp osv.dev
- VulDB entry 417543 vuldb.com
- Vulners Rapid7 CVE-2026-63316 vulners.com
- EUVD-2026-93500 (overlapping ID) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:32.
Original description (NVD)
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.