The flaw allows authenticated users with create or update permissions on an upload-enabled collection to persuade the server to perform HTTP requests to arbitrary URLs. This Server‑Side Request Forgery can be used to reach internal or external services, exfiltrate sensitive data or trigger unintended actions, thereby violating confidentiality and availability. The weakness corresponds to CWE‑918, and without remediation it exposes the site to a range of DoS and data leakage scenarios.

Payload CMS, version 3.78 and earlier. The vulnerability exists in all releases before 3.79.1. An update to 3.79.1 or newer eliminates the flaw.

The CVSS score of 7.7 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires a user to be logged in with sufficient collection permissions, so an attacker would need either legitimate credentials or a compromised account. Once authenticated, the SSRF can be triggered via the upload endpoint, enabling outbound connections that the application authority may not intend.