CVE-2026-58200
Received Received - Intake

Cloudinary Signature Forgery in Payload Plugins

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes attacker-controlled body.paramsToSign directly to cloudinary.utils.api_sign_request without a key allowlist, collection policy, timestamp freshness check, or configured-folder enforcement. Any authenticated Payload user can obtain a valid Cloudinary HMAC-SHA1 signature for unauthorized parameters such as overwrite, type, notification_url, invalidate, folder, and public_id. The signature can authorize asset replacement, upload visibility changes, callbacks to attacker-selected URLs, cache invalidation, and uploads outside the intended folder. The client-visible Cloudinary API key is expected by the upload design, but the unrestricted server-side signature supplies the authorization value needed to complete these operations. This vulnerability is fixed in 0.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-58200
EUVD
EUVD-2026-78825

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jhb.software payload-cloudinary-plugin to 0.4.0 (exc)
jhb.software payload-cloudinary-plugin 0.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @jhb.software/payload-cloudinary-plugin for Payload CMS versions 0.3.0 to 0.4.0. It allows authenticated users to generate unauthorized Cloudinary HMAC-SHA1 signatures by passing attacker-controlled parameters directly to a signing function without validation. This can lead to unauthorized actions like asset replacement, visibility changes, or callbacks to attacker-controlled URLs.

Impact Analysis

If you use the affected plugin with clientUploads enabled, an attacker with access to your Payload CMS could manipulate Cloudinary uploads. This includes replacing existing assets, changing visibility settings, triggering callbacks to malicious URLs, or uploading files outside intended folders. The impact depends on your Cloudinary configuration and the permissions of the compromised account.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data integrity, confidentiality) or HIPAA (protected health information integrity). Unauthorized asset replacements or callbacks might expose sensitive data or trigger unintended processing, creating compliance risks depending on the data involved.

Mitigation Strategies

Immediately upgrade to version 0.4.0 or later of @jhb.software/payload-cloudinary-plugin to address the vulnerability. Disable clientUploads if not required or restrict access to the POST /api/cloudinary-generate-signature endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58200. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart