Skip to content
Threat Feed
Subscribe

Product

@Payloadcms/Plugin-Form-Builder (< 3.90.0, >= 4.0.0-Canary.0 < 4.0.0-Canary.34)

1 brief RSS
critical advisory

Remote Code Execution in @payloadcms/plugin-form-builder

A critical remote code execution vulnerability (CVE-2026-105857) in @payloadcms/plugin-form-builder allows unauthenticated attackers to execute arbitrary code via crafted form submissions.

@payloadcms/plugin-form-builder remote-code-execution web-application-vulnerability payloadcms
1c