MajorCritical vulnerability
CVE-2026-105868: Payload: Uploaded XML files could execute same-origin JavaScript
GitHub Advisories · officialPublished Oct 7, 2026Risk 37/100
### Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. You are affected if: - You accept XML uploads (accepted by default). ### Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds Disallow XML/XSL uploads.
Recommended action
Recommended action
Upgrade affected packages to a patched version: payload 3.90.0, payload 4.0.0-canary.34.
Technical details
- Vendor
- Not specified
- Product
- payload
- Exploitation
- none known
- Evidence
- official
Evidence and sources
This record is attributed to GitHub Advisories. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source