Stored XSS in Payload CMS via XML Upload

Executive Summary

Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 have a vulnerability where local upload configurations accepting XML files can store malicious XML and stylesheets. When a logged-in user opens the file, JavaScript executes in the Payload origin.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by checking Payload CMS versions before 3.90.0 or canary versions before 4.0.0-canary.34. Inspect uploaded XML files for suspicious JavaScript execution in stylesheets. Review server logs for unexpected file uploads or access patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload a malicious XML file and stylesheet to exploit this vulnerability. If a logged-in user accesses the file, the attacker could execute arbitrary JavaScript in the context of the Payload CMS application, potentially leading to data theft, session hijacking, or other malicious actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected versions may face compliance violations, data breaches, and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Payload CMS to version 3.90.0 or 4.0.0-canary.34 or later. Remove or restrict local upload configurations that accept XML files. Implement strict file upload validation to block XML files with embedded scripts.

Useful 0 Not Useful 0