This CVE exposes a Server‑Side Request Forgery flaw in the external file upload feature of Payload CMS. The system fails to properly validate HTTP redirects when an external URL is supplied, allowing an authenticated attacker with write permission on an upload‑enabled collection to force the server to request arbitrary internal resources and retrieve their responses. The attacker could thus obtain data from internal services or platforms that should otherwise be unreachable from the public network.

Payload CMS versions prior to 3.75.0 are vulnerable. All installations of payloadcms:payload that have at least one collection with upload enabled and a user who can create uploads in that collection are affected.

The CVSS score is 6.5, indicating medium severity, while the EPSS probability is under 1%, signifying a relatively low likelihood of exploitation. The vulnerability is not listed in KEV. Exploitation requires an authenticated session and proper permissions on an upload‑enabled collection; once those conditions are met, the attacker can discover or read data from internal hosts via crafted redirects.