GHSA-r488-j9vj-wx3qCriticalCVSS 10.0

Payload Form Builder has an RCE issue

Published
October 7, 2026
Last Modified
October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-105857 →

📋 Description

Impact

A vulnerability in @payloadcms/plugin-form-builder in versions < 3.90.0 allow submissions which could be crafted to execute remote code on the server.

You are affected if:

  • You are using @payloadcms/plugin-form-builder

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

🎯 Affected products2

  • npm/@payloadcms/plugin-form-builder:< 3.90.0
  • npm/@payloadcms/plugin-form-builder:>= 4.0.0-canary.0, < 4.0.0-canary.34

🔗 References (5)