Payload versions prior to 3.79.1 are vulnerable to an authenticated Server-Side Request Forgery flaw that could lead to unauthorized internal network reconnaissance.

This is a Server-Side Request Forgery (CWE-918) vulnerability occurring within the upload functionality of the application. The flaw requires an authenticated user with create or update permissions for an upload-enabled collection to trigger arbitrary outbound requests from the server.

The ability for an authenticated user to force server-side requests presents a significant security risk, as it may allow attackers to bypass network segmentation to probe internal services or cloud metadata endpoints. With a CVSS score of 7.7, this vulnerability is classified as High severity, necessitating prompt remediation to prevent potential data exfiltration or internal infrastructure compromise.

Immediate Action: Update the Payload CMS installation to version 3.79.1 or later to implement the vendor-supplied fix.

Proactive Monitoring: Review server egress traffic logs for unusual HTTP requests originating from the application server, particularly those directed toward internal IP ranges or sensitive cloud metadata services.

Compensating Controls: Implement strict egress filtering on the application server host to limit outbound connections to only necessary and trusted external endpoints.

Public Exploit Available: No (exploit_available: false).

Given the High severity of this SSRF vulnerability, administrators should prioritize updating to version 3.79.1 immediately. Restricting the privileges of users who have access to upload-enabled collections serves as a necessary secondary defense until the patch is successfully applied.