Cpe:2.3:a:payload:plugin_import_export:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apayloadplugin_import_export/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 06 Oct 2026 18:45:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrototype Pollution Vulnerability in Payload Import Export Pluginhttps://feed.craftedsignal.io/briefs/2026-10-payload-prototype-pollution/Tue, 06 Oct 2026 18:45:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-payload-prototype-pollution/An unauthenticated prototype pollution vulnerability in the Payload Import Export plugin allows remote attackers to achieve code execution via malicious input.A prototype pollution vulnerability has been identified in the @payloadcms/plugin-import-export package, tracked as CVE-2026-105844. This vulnerability affects versions 3.0.0 through 3.87.9 and canary versions between 4.0.0-canary.0 and 4.0.0-canary.26. The flaw exists within the plugin's data handling logic, which fails to properly sanitize input before processing. An unauthenticated attacker can exploit this weakness by submitting specifically crafted JSON payloads to the plugin's endpoints. By polluting the object prototype, the attacker can influence application-wide behavior, potentially leading to remote code execution (RCE). This issue is limited to environments where the Import Export plugin is explicitly enabled.

Impact

Successful exploitation allows an unauthenticated attacker to achieve remote code execution within the context of the Payload CMS application. This could result in full system compromise, data theft, or service disruption. All organizations utilizing the affected plugin version are at risk if the application is internet-facing or accessible to untrusted users.

Recommendation

  • Upgrade the @payloadcms/plugin-import-export package to version 3.88.0 or 4.0.0-canary.27 or later.
  • If an immediate upgrade is not feasible, disable the Import Export plugin entirely or implement strict network-level access controls to restrict access to the plugin's API endpoints.
  • Monitor web application logs for unexpected JSON structures or suspicious requests directed at import or export functional routes.
]]>criticaladvisoryweb-applicationprototype-pollutionrcesupply-chain