CVE-2026-34750

CVE-2026-34750 identifies a path traversal vulnerability (CWE-22) in the client-upload signed-URL endpoints of @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, affecting versions prior to 3.78.0. This flaw allows an authenticated attacker with low privileges to craft malicious filenames, enabling them to escape the intended storage location and achieve high integrity impact by potentially overwriting or placing files in arbitrary locations on the storage backend. Rated with a CVSS score of 6.5 (Medium), the vulnerability has a low attack complexity and requires no user interaction, making it a straightforward network-based attack. There is currently no evidence of active exploitation, nor are there any public exploit modules available, and community discussion remains minimal.