External risk intelligence

Payload Form Builder Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-105857

The vulnerability exists in a plugin for a headless Content Management System. CMS platforms and their form-building components are commonly deployed as public-facing web applications or API endpoints, making them inherently accessible via the internet as part of their standard functional design.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical vulnerability in a popular headless content management system's form builder plugin. An unauthenticated attacker could exploit this flaw to execute arbitrary code on the server, potentially leading to a complete system compromise. The main concern is confirming whether this specific plugin is in use and, if so, assessing the associated exposure.

Code execution vulnerability in form builder.
Affects systems using the form builder plugin.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can send a specially crafted form submission to a vulnerable Payload CMS instance. If successful, this submission allows the attacker to execute arbitrary code on the server, potentially leading to a complete compromise of the system.

Publicly accessible endpoint required.
Malicious form submission.
Remote code execution on server.

Live Threat

Current exploitation, exposure, and threat context

A specially crafted form submission could allow an unauthenticated attacker to execute arbitrary code on the server when supported by the advisory. This could impact the integrity and availability of the system and any data it manages.

Server-side code execution.
Unauthenticated network access.
Compromise of system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application and platform teams are likely responsible for addressing this critical vulnerability in the form builder plugin, as headless CMS platforms are often internet-facing. The first step is to identify all instances of the affected technology, confirm their exposure and business criticality, and then assign an owner for remediation planning.

Identify affected deployments and owners.
Verify internet exposure and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Payload and the form builder plugin?

Payload is a headless content management system used by developers to manage website content via APIs rather than traditional page templates. The form builder plugin is an optional component for this platform that enables administrators to dynamically create and manage web forms, allowing visitors to submit data directly into the system's backend.

What does CVE-2026-105857 mean for system security?

This vulnerability involves Improper Control of Generation of Code and Improperly Controlled Modification of Object Prototype Attributes, classified as CWE-94 and CWE-1321. In plain terms, the plugin fails to safely process incoming form data, which an attacker can manipulate to inject and run unauthorized commands on the underlying server, bypassing normal security controls.

How does an attacker trigger this vulnerability?

An attacker triggers the bug by sending a specifically formatted web request to the form submission endpoint of an affected Payload application. This flaw requires the application to actively process form submissions to be exploited; standard read-only page loads or administrative dashboard access that does not involve the form builder plugin logic will not trigger this execution path.

Is my system at risk if it uses this plugin?

According to Halo Surface Signal, because headless CMS platforms and their form-building components are designed to serve public web traffic or provide API endpoints, they are often exposed to the internet. If your Payload instance is reachable from the public web and includes the vulnerable plugin, it is considered a likely target for remote exploitation.

What should I do first to secure my infrastructure?

Start by identifying all deployed instances of Payload and verifying if the form builder plugin is enabled. Prioritize these findings by business criticality and internet accessibility. Once identified, plan to update to version 3.90.0 or 4.0.0-canary.34, which contain the necessary code changes to sanitize inputs and prevent unauthorized server-side execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.