CVE-2026-25544
Published: 06 February 2026
Summary
CVE-2026-25544 is a critical-severity SQL Injection (CWE-89) vulnerability in Payloadcms Payload. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-25544 is a blind SQL injection vulnerability in Payload, a free and open source headless content management system. Prior to version 3.73.0, user input provided when querying JSON or richText fields was directly embedded into SQL queries without proper escaping, allowing attackers to manipulate database operations. The issue is classified under CWE-89 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high confidentiality, integrity, and availability impacts.
An unauthenticated attacker can exploit this vulnerability remotely over the network with low complexity and no privileges required. By crafting malicious queries, they can extract sensitive data such as user emails and password reset tokens from the database. This enables full account takeover without needing to crack passwords, potentially compromising entire user bases.
The vulnerability was published on 2026-02-06 and fixed in Payload version 3.73.0. The official advisory at https://github.com/payloadcms/payload/security/advisories/GHSA-xx6w-jxg9-2wh8 details the patch, recommending immediate upgrades to the fixed version for mitigation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5570
Vulnerability details
Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive…
more
data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Blind SQL injection in public-facing Payload CMS web app directly enables remote unauthenticated exploitation for data access and account takeover per T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of user inputs for JSON and richText fields to prevent direct embedding into SQL queries without escaping, directly mitigating the blind SQL injection vulnerability.
Mandates timely identification, reporting, and correction of the specific SQL injection flaw fixed in Payload 3.73.0 through patching and updates.
Vulnerability scanning detects the SQL injection issue in Payload CMS and drives remediation to prevent exploitation by unauthenticated attackers.