CVE-2026-105865

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34

Description An authenticated user with permissions to update or delete locally stored uploads can trigger a file cleanup process that removes unintended files outside the configured upload directory. This can lead to data loss or service disruption. The risk is lower for deployments that restrict upload management to trusted users.

Recommendations Update to version 3.90.0. Update to canary version 4.0.0-canary.34.