A vulnerability in Payload CMS allows an attacker to upload an XML file containing a stylesheet that, when opened by a logged‑in user, executes arbitrary JavaScript within the same origin, potentially enabling the attacker to manipulate data, exfiltrate credentials, or perform actions on behalf of that user.

The flaw affects payloadcms’s Payload content management system in all releases prior to 3.90.0 and before canary 4.0.0-canary.34, where local upload configurations permit XML files to be stored.

With a CVSS score of 8.6, the vulnerability is considered high severity; the EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to submit a crafted XML file and a targeted victim to open it, making the attack probable in environments that allow XML uploads and have authenticated users who can access the uploaded file.