6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27567

CVE-2026-27567: Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at least one collection with upload enabled and a user who has create access to that upload-enabled collection in order to be vulnerable. An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application. This vulnerability has been patched in v3.75.0. As a workaround, one may mitigate this vulnerability by disabling external file uploads via the disableExternalFile upload collection option, or by restricting create access on upload-enabled collections to trusted users only.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27567

CVE-2026-27567:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
payload	npm	< 3.75.0	3.75.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the external file upload functionality of Payload CMS. The root cause was the automatic following of HTTP redirects when fetching a file from a user-provided URL. An attacker could supply a URL that passed the initial security checks but then redirected to a URL on the internal network, bypassing the validation.

The analysis of the patch commit 1041bb6 reveals changes in two key files: packages/payload/src/uploads/getExternalFile.ts and packages/payload/src/uploads/safeFetch.ts.

safeFetch in packages/payload/src/uploads/safeFetch.ts: The patch adds redirect: 'manual' to the options passed to undiciFetch. Before this change, safeFetch would automatically follow redirects, making it a component in the SSRF vulnerability chain.
getExternalFile in packages/payload/src/uploads/getExternalFile.ts: This function orchestrates the file download. The patch replaces the direct call to fetch or safeFetch with a while loop that manually handles redirects. It inspects the Location header of 3xx responses, re-runs security checks on the new URL, and limits the total number of redirects to prevent loops. The original implementation lacked this manual redirect handling, making it the primary vulnerable function.

Therefore, both getExternalFile and the original version of safeFetch are identified as the vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

getExternalFile

packages/payload/src/uploads/getExternalFile.ts

The `getExternalFile` function was vulnerable to SSRF because it used `fetch` or `safeFetch` which followed HTTP redirects by default. An attacker could provide a URL that passed initial validation but redirected to an internal service. The patch fixes this by manually handling redirects within a loop, re-validating the URL at each step, and limiting the number of redirects.

safeFetch

packages/payload/src/uploads/safeFetch.ts

The `safeFetch` function was part of the vulnerable execution flow. It was called by `getExternalFile` and, prior to the patch, it automatically followed HTTP redirects by default. This allowed an attacker-controlled URL to redirect to internal network resources. The patch mitigates this by setting the `redirect` option to `'manual'`, preventing automatic redirects.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.