Is CVE-2026-27567 actively exploited?

No active exploitation of CVE-2026-27567 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27567 be exploited remotely?

Yes. CVE-2026-27567 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-27567?

CVE-2026-27567 has a CVSS score of 4.8 (MEDIUM) and an EPSS exploitation probability of 0.02%.

HOME VULNERABILITIESCVE-2026-27567

MEDIUM

CVE-2026-27567

CWE-918Published: February 24, 2026· Updated: Feb 26, 2026

4.8

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.0th

Official Description

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at least one collection with `upload` enabled and a user who has `create` access to that upload-enabled collection in order to be vulnerable. An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application. This vulnerability has been patched in v3.75.0. As a workaround, one may mitigate this vulnerability by disabling external file uploads via the `disableExternalFile` upload collection option, or by restricting `create` access on upload-enabled collections to trusted users only.

NVD Source

Technical Analysis

CVE-2026-27567 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.