PT-2026-106807 · Pyload · Pyload
CVE-2026-105868
·
Published
2026-10-06
·
Updated
2026-10-06
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Payload versions prior to 3.90.0
Payload canary versions prior to 4.0.0-canary.34
Description
Local upload configurations that accept XML files allow the storage of an XML file and stylesheet. This can lead to the execution of JavaScript within the Payload origin when a logged-in user opens the file.
Recommendations
Update to version 3.90.0.
Update to canary version 4.0.0-canary.34.
Exploit
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pyload