CVE-2026-105857

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-form-builder versions prior to 3.90.0 @payloadcms/plugin-form-builder versions prior to 4.0.0-canary.34

Description An issue exists where the plugin mishandles crafted form submission payloads, allowing an unauthenticated attacker to trigger server-side code execution during the submission processing. This leads to full Remote Code Execution (RCE), which is the ability of an attacker to execute arbitrary commands on a remote machine over a network.

Recommendations Update @payloadcms/plugin-form-builder to version 3.90.0. Update @payloadcms/plugin-form-builder to version 4.0.0-canary.34.