What is GHSA-6r7f-q7f5-wpx8?

GHSA-6r7f-q7f5-wpx8 is a security advisory published by GitHub Security Advisories with High severity. Payload has Authenticated SSRF via Upload Functionality

Which CVE IDs does GHSA-6r7f-q7f5-wpx8 cover?

GHSA-6r7f-q7f5-wpx8 covers the following CVE IDs: CVE-2026-34746. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6r7f-q7f5-wpx8?

GHSA-6r7f-q7f5-wpx8 has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

Which products are affected by GHSA-6r7f-q7f5-wpx8?

GHSA-6r7f-q7f5-wpx8 affects 1 product, including: npm/payload:\u003c 3.79.1.

GHSA-6r7f-q7f5-wpx8HighCVSS 7.7

Payload has Authenticated SSRF via Upload Functionality

Vendor

GitHub Security Advisories

Published

April 1, 2026

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-34746 →

📋 Description

Impact

An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.

Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.

Consumers are affected if ALL of these are true:

Payload version < v3.79.1
At least one collection with upload enabled
An authenticated user has create or update access to that collection

Patches

This vulnerability has been patched in v3.79.1. Users should upgrade to v3.79.1 or later.

Workarounds

Until consumers can upgrade:

Restrict create and update access to upload-enabled collections to trusted roles only.
Limit outbound network access from your Payload server where possible.

🎯 Affected products1

npm/payload:< 3.79.1