CVE-2026-34747

High

Published: 01 April 2026

Published

01 April 2026

Modified

13 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

EPSS Score 0.0032 23.3th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-34747 is a high-severity SQL Injection (CWE-89) vulnerability in Payloadcms Payload. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-34747 is a SQL injection vulnerability (CWE-89) in Payload, a free and open-source headless content management system. Prior to version 3.79.1, the software fails to properly validate certain request inputs, allowing attackers to craft malicious requests that influence SQL query execution. This could result in the exposure or modification of data within collections. The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), indicating high severity due to its network accessibility, low complexity, and cross-scope impact.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network without user interaction. By sending specially crafted requests, they can manipulate SQL queries to achieve high confidentiality impact, such as extracting sensitive data from collections, and low integrity impact, such as limited data modification. The high scope (S:C) amplifies the risk, as exploitation affects not only the vulnerable component but also related system resources.

The issue has been addressed in Payload version 3.79.1, where input validation was strengthened to prevent SQL injection. Security practitioners should upgrade to this version or later. Official details are available in the Payload release notes at https://github.com/payloadcms/payload/releases/tag/v3.79.1 and the GitHub security advisory at https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-18013

Vulnerability details

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This…

issue has been patched in version 3.79.1.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in a network-accessible headless CMS directly maps to exploitation of public-facing applications, enabling remote authenticated attackers to manipulate database queries for data exposure or modification.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0