Payload CMS patches authenticated SQL injection flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT Polska coordinated disclosure of CVE-2026-63316, a SQL injection in Payload CMS query parameters, fixed in versions 3.90.0 and 4.0.0-canary.34.
CERT Polska disclosed CVE-2026-63316, a SQL injection vulnerability in Payload CMS, a headless content management system. The flaw stems from improper neutralization of user-supplied input in the 'in' and 'not_in' query parameters, which allows an authenticated attacker to inject and execute arbitrary SQL commands against the backend database. Exploitation requires the attacker to already hold valid credentials on the target instance, limiting the blast radius to insiders or accounts compromised through other means, but successful exploitation could expose, modify, or exfiltrate database contents depending on the privileges of the application's database user.
The vulnerability was reported through CERT Polska's coordinated vulnerability disclosure process, credited to researcher 0xMesbaha, and has been fixed by the Payload CMS maintainers in version 3.90.0 of the stable branch and 4.0.0-canary.34 of the canary branch. There is no indication in this advisory of active exploitation in the wild. Defenders running Payload CMS should prioritize upgrading to a patched version, review authenticated user accounts and their database privileges, and audit query logs for anomalous use of 'in'/'not_in' filter parameters as a precaution.
Mentioned in this report
Detection guidance
Payload CMS Query In/Not_In Parameter With SQL Injection Syntax
Detects web requests where the Payload CMS 'in' or 'not_in' where-filter parameter carries UNION or boolean-style SQL injection syntax (CVE-2026-63316). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Payload CMS Query In/Not_In Parameter With SQL Injection Syntax
id: 90f91acd-acf9-50a0-85b0-4358f842acc1
status: experimental
description: Detects HTTP requests whose query string uses the Payload CMS where[field][in]
or where[field][not_in] filter together with UNION or boolean-based SQL injection
syntax. Relates to CVE-2026-63316, which needs authenticated access. The pattern
is generic and not tied to a specific collection or field name.
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-63316
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_param:
cs-uri-query|contains:
- '[in]'
- '[not_in]'
- '%5Bin%5D'
- '%5Bnot_in%5D'
selection_sqli:
cs-uri-query|contains:
- union select
- union all select
- union%20select
- union%20all%20select
- union+select
- union+all+select
- or 1=1
- or%201=1
- or+1=1
- ''' or '''
- '''%20or%20'''
- '%27%20or%20%27'
- '''--'
- '%27--'
- '''/*'
condition: selection_param and selection_sqli
falsepositives:
- Authorised penetration tests or vulnerability scans against the CMS
- Content searches that legitimately contain SQL keywords inside an in-filter value
level: medium
author: Vorant
Payload CMS Query In/Not_In Parameter With Time-Based or Schema-Enumeration SQL Functions
Detects Payload CMS where[field][in]/[not_in] filters containing SQL sleep functions, schema enumeration or stacked queries, indicating blind SQL injection (CVE-2026-63316). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Payload CMS Query In/Not_In Parameter With Time-Based or Schema-Enumeration
SQL Functions
id: f4772f6c-e164-5ece-adc9-8c129d744313
status: experimental
description: Detects HTTP requests that use the Payload CMS where[field][in] or where[field][not_in]
filter together with SQL time-delay functions, error-based extraction functions,
system catalog references or stacked queries. These indicate blind or error-based
exploitation of an authenticated SQL injection flaw (CVE-2026-63316).
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-63316
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_param:
cs-uri-query|contains:
- '[in]'
- '[not_in]'
- '%5Bin%5D'
- '%5Bnot_in%5D'
selection_sqli:
cs-uri-query|contains:
- pg_sleep
- sleep(
- sleep%28
- waitfor delay
- waitfor%20delay
- benchmark(
- benchmark%28
- extractvalue(
- updatexml(
- information_schema
- pg_catalog
- sqlite_master
- ;select
- '%3bselect'
- ;drop
- '%3bdrop'
condition: selection_param and selection_sqli
falsepositives:
- Authorised penetration tests or vulnerability scans against the CMS
- Documentation or knowledge-base content queries that legitimately reference terms
such as information_schema
level: high
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-63316
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs