CriticalCritical vulnerability
CVE-2026-105857: Payload Form Builder has an RCE issue
GitHub Advisories · officialPublished Oct 7, 2026Risk 50/100
## Impact A vulnerability in `@payloadcms/plugin-form-builder` in versions < 3.90.0 allow submissions which could be crafted to execute remote code on the server. **You are affected if:** - You are using `@payloadcms/plugin-form-builder` ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
Recommended action
Recommended action
Upgrade affected packages to a patched version: @payloadcms/plugin-form-builder 3.90.0, @payloadcms/plugin-form-builder 4.0.0-canary.34.
Technical details
- Vendor
- Not specified
- Product
- @payloadcms/plugin-form-builder
- Exploitation
- none known
- Evidence
- official
CVSS
10.0
Evidence and sources
This record is attributed to GitHub Advisories. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source