9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25544

CVE-2026-25544: Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25544

CVE-2026-25544:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@payloadcms/drizzle	npm	< 3.73.0	3.73.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of user input within JSON and RichText field queries for databases using the Drizzle adapter in Payload CMS. An attacker could craft a malicious query that, when processed, would be executed by the database, leading to a blind SQL injection. This would allow the unauthorized extraction of sensitive data.

The investigation started by comparing the git tags for the last vulnerable version (v3.72.0) and the first patched version (v3.73.0). A specific commit, 4f5a9c28346aaea78d53240166000d7210c35fc7, was identified as the security patch. This commit, while titled as a bug fix for a different issue, contains the crucial security fix.

The key change is within the getBuildQueryJoinQuery function located in packages/db-drizzle/src/queries/getBuildQueryJoinQuery.ts. Before the patch, user-controlled values were being directly concatenated into the SQL query string. The patch modifies this function to use parameterized queries, where user input is treated as data and not as part of the SQL command. This is evident from the change from sql(${jsonQuery}) to `sql`(${sql.raw(jsonQuery)}), which, in context of the broader changes in the associated pull request, is part of a shift to safer, parameterized queries. This prevents the SQL injection vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.