Payload CMS Insufficient Filename Validation in Client-Upload Signed-URL Endpoints

A vulnerability exists in Payload CMS versions prior to 3.78.0 across several storage adapters, including Azure, GCS, R2, and S3. The issue arises from the client-upload signed-URL endpoints, which failed to properly validate filenames. This lack of validation allowed attackers to craft filenames that could escape the designated storage location.

Impact

Exploitation of this vulnerability could lead to unauthorized access or manipulation of files, as crafted filenames could be used to bypass intended storage restrictions.

Remediation

Users are advised to upgrade to Payload CMS version 3.78.0 or later, where this vulnerability has been addressed. Until an upgrade can be performed, access to client-upload signed-URL endpoints should be restricted to trusted users only.