{"id":"CVE-2026-34747","aliases":["GHSA-7xxh-373w-35vg"],"url":"https://o3.security/vulnerability/CVE-2026-34747","summary":"Payload has an SQL Injection via Query Handling","details":"### Impact\n\nCertain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.\n\n### Patches\n\nThis issue has been fixed in **v3.79.1** and later. Query input validation has been hardened.\n\nUpgrade to **v3.79.1 or later**.\n\n### Workarounds\n\nUntil developers can upgrade:\n\n- Limit access to endpoints that accept dynamic query inputs to trusted users only.  \n- Validate or sanitize input from untrusted clients before sending it to query endpoints.","published":"2026-04-01T19:45:24.463Z","modified":"2026-10-28T02:30:26.486239355Z","cvss":{"score":8.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"},"epss":{"score":0.00317,"percentile":0.24667,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"payload","fixedVersion":"3.79.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/payloadcms/payload/releases/tag/v3.79.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34747.json"},{"type":"ADVISORY","url":"https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34747"},{"type":"PACKAGE","url":"https://github.com/payloadcms/payload"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:26.486239355Z"}}