storage-s3: Changing uploaded Media fails with "Blocked unsafe attempt" in v3.43.0

[nettags]

Describe the Bug

s3 storage: Changing an image that has already been uploaded throws the following error: "An error occurred while uploading the file.. Blocked unsafe attempt to http://xxx" in Payload v3.43.0.

Earlier versions are not affected; there is no error after downgrading to version 3.42.

Thanks in advance for checking this out.

Link to the code that reproduces this issue

pnpx create-payload-app@latest -t website

Reproduction Steps

These steps are based on the Website template:

1.) Enable the s3 storage plugin:

s3Storage({
      collections: {
        media: true,
      },
      bucket: process.env.S3_BUCKET_NAME || '',
      config: {
        region: process.env.S3_REGION || '',
        endpoint: process.env.S3_ENDPOINT || '',
        credentials: {
          accessKeyId: process.env.S3_ACCESS_KEY || '',
          secretAccessKey: process.env.S3_SECRET_KEY || '',
        },
      },
    }),

2. Upload an image to the Media collection – this works without any issues.

3. Edit the image, for example by changing the alt text, and click Save.

4. An error is thrown and the image is not updated. See the error in the logs:

err: {
      "type": "FileRetrievalError",
      "message": "An error occurred while uploading the file.. Blocked unsafe attempt to http://localhost:3020/api/media/file/dummy-upload.png",
...}

Which area(s) are affected? (Select all that apply)

plugin: cloud-storage

Environment Info

Binaries:
  Node: 20.19.0
  npm: 10.8.2
  Yarn: N/A
  pnpm: 10.3.0
Relevant Packages:
  payload: 3.43.0
  next: 15.3.0
  @payloadcms/db-mongodb: 3.43.0
  @payloadcms/email-nodemailer: 3.43.0
  @payloadcms/graphql: 3.43.0
  @payloadcms/live-preview: 3.43.0
  @payloadcms/live-preview-react: 3.43.0
  @payloadcms/next/utilities: 3.43.0
  @payloadcms/payload-cloud: 3.43.0
  @payloadcms/plugin-cloud-storage: 3.43.0
  @payloadcms/plugin-form-builder: 3.43.0
  @payloadcms/plugin-nested-docs: 3.43.0
  @payloadcms/plugin-redirects: 3.43.0
  @payloadcms/plugin-seo: 3.43.0
  @payloadcms/richtext-lexical: 3.43.0
  @payloadcms/storage-s3: 3.43.0
  @payloadcms/translations: 3.43.0
  @payloadcms/ui/shared: 3.43.0
  react: 19.1.0
  react-dom: 19.1.0
Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.5.0: Tue Apr 22 19:53:27 PDT 2025; root:xnu-11417.121.6~2/RELEASE_ARM64_T6041
  Available memory (MB): 24576
  Available CPU cores: 12

[github-actions]

Please add a reproduction in order for us to be able to investigate.

Depending on the quality of reproduction steps, this issue may be closed if no reproduction is provided.

Why was this issue marked with the invalid-reproduction label?

To be able to investigate, we need access to a reproduction to identify what triggered the issue. We prefer a link to a public GitHub repository created with create-payload-app@latest -t blank or a forked/branched version of this repository with tests added (more info in the reproduction-guide).

To make sure the issue is resolved as quickly as possible, please make sure that the reproduction is as minimal as possible. This means that you should remove unnecessary code, files, and dependencies that do not contribute to the issue. Ensure your reproduction does not depend on secrets, 3rd party registries, private dependencies, or any other data that cannot be made public. Avoid a reproduction including a whole monorepo (unless relevant to the issue). The easier it is to reproduce the issue, the quicker we can help.

Please test your reproduction against the latest version of Payload to make sure your issue has not already been fixed.

I added a link, why was it still marked?

Ensure the link is pointing to a codebase that is accessible (e.g. not a private repository). "example.com", "n/a", "will add later", etc. are not acceptable links -- we need to see a public codebase. See the above section for accepted links.

Useful Resources

• Reproduction Guide
• Contributing to Payload

[fedosev]

Same issue without s3 (local storage). It seems to be an issue after adding safeFetch. There is no checking for allowList. Was there some sort of merge issues? packages/payload/src/uploads/getExternalFile.ts

[JayBee007]

The issue is with how isSafeIp works, more info here #12870

[luochuanyuewu]

Same issue here after upgrade to 3.43

[virus-rpi]

i have the same error with the vercel blob storage

[JesperWe]

Same issue here using Digital Ocean S3 storage

[tsemachh]

@nettags this happens also on GCS and local storage , this is regression because of the change done by @kendelljoseph
#12622 there are also remarks there , this needs to get prioritiy

[lukebennett]

Yes, totally broken here too (using R2 via S3 but doesn't appear to be provider specific). Can't update any uploads at the moment.

[TwR-Slice]

+1 unable to edit

[roymandev]

+1 unable to edit