CVE-2026-34747

High

Published: 01 April 2026

Published

01 April 2026

Modified

13 April 2026

KEV Added

—

Patch

—

CVSS Score 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

EPSS Score 0.0008 22.4th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34747 is a high-severity SQL Injection (CWE-89) vulnerability in Payloadcms Payload. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the CVE by requiring validation of request inputs to prevent SQL injection attacks that influence query execution.

SI-2 Flaw Remediation good match

prevent

Ensures timely identification, reporting, and remediation of the SQL injection flaw via patching to version 3.79.1 or later.

SI-9 Information Input Restrictions partial match

prevent

Restricts request inputs to block malicious payloads that could be used to manipulate SQL queries in Payload CMS.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in a network-accessible headless CMS directly maps to exploitation of public-facing applications, enabling remote authenticated attackers to manipulate database queries for data exposure or modification.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This…

issue has been patched in version 3.79.1.

Deeper analysisAI

CVE-2026-34747 is a SQL injection vulnerability (CWE-89) in Payload, a free and open-source headless content management system. Prior to version 3.79.1, the software fails to properly validate certain request inputs, allowing attackers to craft malicious requests that influence SQL query execution. This could result in the exposure or modification of data within collections. The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), indicating high severity due to its network accessibility, low complexity, and cross-scope impact.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network without user interaction. By sending specially crafted requests, they can manipulate SQL queries to achieve high confidentiality impact, such as extracting sensitive data from collections, and low integrity impact, such as limited data modification. The high scope (S:C) amplifies the risk, as exploitation affects not only the vulnerable component but also related system resources.

The issue has been addressed in Payload version 3.79.1, where input validation was strengthened to prevent SQL injection. Security practitioners should upgrade to this version or later. Official details are available in the Payload release notes at https://github.com/payloadcms/payload/releases/tag/v3.79.1 and the GitHub security advisory at https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg.