Payload CMS versions before 3.90.0 and canary releases before 4.0.0-canary.34 allow an authenticated user with permission to edit or delete uploads to trigger a cleanup routine that removes files outside the configured upload directory. The flaw stems from insufficient path validation, giving the attacker the ability to delete arbitrary files on the server, leading to data loss or service disruption. The weaknesses involved are path traversal (CWE-22) and absolute path traversal (CWE-73).

The affected product is Payload CMS from payloadcms. Users running versions earlier than 3.90.0, or any canary release before 4.0.0-canary.34, remain vulnerable. The vendor noted that deployments which restrict upload management to trusted users experience a lower risk level.

The vulnerability carries a CVSS score of 8.1, indicating a high impact if exploited. The EPSS score is not provided, so the current exploitation likelihood is unknown, but the issue has not yet been reported in the CISA KEV catalog. Because the attack requires authenticated access with upload‑management privileges, a compromise of those credentials or the use of an existing administrator account would be required. The flaw is publicly disclosed and a patch has been released in the 3.90.0 and 4.0.0-canary.34 releases.