Payload CMS allows users to upload SVG files to a collection configured for downloads. An attacker can prepare a malicious SVG containing embedded JavaScript and upload it through the same endpoint. When a user downloads and opens the SVG, the browser executes the attacker‑controlled script in the victim’s context, leading to theft of credentials, session hijacking, or other malicious actions. The weakness is described by CWE‑434 (Unrestricted Upload of File with Dangerous Type) and CWE‑79 (Cross‑Site Scripting), and its CVSS score of 8.7 reflects a high severity of client‑side exploitation.

The flaw affects Payload CMS versions before 3.90.0 and canary releases before 4.0.0‑canary.34. Any deployment that has a collection set to allow downloadable SVG uploads is vulnerable regardless of the user’s authentication level.

Because the upload endpoint is exposed over the network, an attacker can deliver a malicious SVG by simply posting a file to the vulnerable collection. The CVSS metric indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation is currently limited. Nonetheless, the potential for arbitrary client‑side script execution in the victim’s browser warrants immediate remediation.