payload 3.78.0-internal-debug.f663370

Direct Vulnerabilities

Known vulnerabilities in the payload package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Brute Force payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Brute Force due to insufficient access control in the `unlock` process. An attacker can regain access to a locked account by exploiting the default unlock mechanism. How to fix Brute Force? There is no fixed version for `payload`.	>=0.0.0
M Server-side Request Forgery (SSRF) payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the `upload` endpoint. An attacker can cause the server to initiate unauthorized outbound HTTP requests to arbitrary URLs by submitting crafted data as an authenticated user with create or update access to an upload-enabled collection. How to fix Server-side Request Forgery (SSRF)? Upgrade `payload` to version 3.79.1 or higher.	<3.79.1
H Directory Traversal payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of filenames in the client-upload signed-URL endpoints for S3, GCS, Azure, and R2. An attacker can escape the intended storage location by submitting specially crafted filenames. How to fix Directory Traversal? Upgrade `payload` to version 3.78.0 or higher.	<3.78.0
M Cross-site Request Forgery (CSRF) payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the authentication flow when `serverURL` is configured. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious site that issues cross-site requests. How to fix Cross-site Request Forgery (CSRF)? Upgrade `payload` to version 3.79.1 or higher.	<3.79.1
M SQL Injection payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to SQL Injection via the endpoints accepting dynamic query for Collections. An attacker can access sensitive information or modify data by submitting specially crafted inputs that manipulate SQL query execution. How to fix SQL Injection? Upgrade `payload` to version 3.79.1 or higher.	<3.79.1
C Weak Password Recovery Mechanism for Forgotten Password payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password in the password recovery flow. An attacker can gain unauthorized access to user accounts by exploiting insufficient input validation of the origin of the password reset request. How to fix Weak Password Recovery Mechanism for Forgotten Password? Upgrade `payload` to version 3.79.1 or higher.	<3.79.1

Vulnerability

Vulnerable Version

Brute Force