Attack Chain

1. Attacker identifies an internet-facing endpoint running Payload CMS, such as /api/posts.
2. Attacker probes the 'where' query parameter to determine if it accepts complex JSON structures.
3. Attacker crafts a malicious JSON payload containing SQL injection characters (e.g., '|| @ == @ || @ == ') to target specific database fields.
4. The application receives the request and passes the attacker-supplied 'where' filter to the Drizzle database adapter.
5. The Drizzle adapter fails to sanitize the input, incorporating the malicious SQL syntax into the query executed against the backend PostgreSQL database.
6. The backend database processes the injected query and returns a modified result set, indicating successful blind SQL injection through time-based or boolean-based inference.
7. Attacker iteratively exfiltrates data from the database by observing the application's responses to varying injected conditions.

Impact

Successful exploitation allows unauthenticated attackers to infer sensitive information from the underlying PostgreSQL database. This can lead to unauthorized data disclosure, including user credentials, metadata, or other proprietary application data stored within the CMS.

Recommendation

Prioritize the following actions to mitigate this threat:

• Upgrade all instances of Payload CMS to version 3.73.0 or later to patch CVE-2026-25544.
• Implement strict input validation on the API gateway level to block requests containing anomalous characters or SQL operators within 'where' filter parameters if an immediate upgrade is not feasible.
• Monitor web server logs for suspicious requests to API endpoints that contain high concentrations of special characters in the 'where' query parameter.