GHSA-frq9-7j6g-v74x
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Quick fix
GHSA-frq9-7j6g-v74x — @payloadcms/storage-azure: upgrade to the fixed version with the command below.
npm install @payloadcms/storage-azure@3.78.0Details
### Impact
The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location.
Consumers are affected if ALL of these are true:
- Payload version **< v3.78.0** - Using client-upload signed-URL endpoints for any supported storage adapter
## Patches
This vulnerability has been patched in **v3.78.0**. Filename validation has been hardened for client uploads.
Consumers should upgrade to **v3.78.0** or later.
## Workarounds
Consumers can upgrade:
- Limit access to client-upload signed-URL endpoints to trusted users only.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 3.78.0npm install @payloadcms/storage-azure@3.78.00Fixed in: 3.78.0npm install @payloadcms/storage-gcs@3.78.00Fixed in: 3.78.0npm install @payloadcms/storage-r2@3.78.00Fixed in: 3.78.0npm install @payloadcms/storage-s3@3.78.0