Payload CMS Stored Cross-Site Scripting Vulnerability in Admin Panel

A stored Cross-Site Scripting vulnerability has been identified in the admin panel of Payload CMS versions prior to 3.78.0. This vulnerability allows an authenticated user with write access to a collection to save content that executes in the browser of another user when viewed. The issue has been patched in version 3.78.0.

Impact

Exploitation of this vulnerability allows for stored Cross-Site Scripting, where injected scripts are executed in the context of the user viewing the content.

Remediation

Users are advised to upgrade to Payload CMS version 3.78.0 or later. If an immediate upgrade is not possible, restrict create and update access to versioned collections to trusted roles only.