Reachy Mini CVE-2026-55419

No special conditions are required for the file upload step itself: the daemon listens on 0.0.0.0 (all interfaces) by default and applies no authentication to /api/media/sounds/upload, so any host with network reachability to the daemon port can exploit this without credentials or prior access. The endpoint does strip directory separators from filenames, preventing path traversal in the upload filename itself, but this does not limit the file type, content, or size. Exploitation is constrained to attackers who can reach the daemon's TCP port - typically the same Wi-Fi or LAN segment the robot is on. Full root impact described in the advisory requires chaining with two additional Bluetooth-side vulnerabilities (authentication bypass and directory traversal); the file upload step alone is limited to writing arbitrary files into /tmp/reachy_mini_sounds/.

The provided CVSS 3.1 score of 5.3 Medium captures the individual vulnerability's bounded impact accurately but materially understates operational risk when the advisory context is factored in: the vendor explicitly documents this as the first link in a kill chain leading to full root OS access on the robot. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly reflects zero-prerequisite network exploitation but scores scope as Unchanged and integrity as Low because in isolation the attacker can only write to a single temp directory. No EPSS data was provided in the input, so exploitation probability cannot be quantified probabilistically. No CISA KEV listing exists. A public PoC (curl command) appears in the GHSA advisory, lowering the technical bar to near zero for any attacker with daemon port access. The product has a narrow robotics-specific deployment footprint, which limits broad internet exposure; however, in environments where Reachy Mini robots are deployed on shared or semi-trusted Wi-Fi segments, the combination of default 0.0.0.0 binding, no authentication, and an available PoC makes this a high-confidence exploitable finding despite the moderate CVSS score.

An attacker on the same network segment as a Reachy Mini robot sends a multipart POST request directly to http://<robot-ip>:<port>/api/media/sounds/upload with a malicious file (e.g., a shell script or binary) as the file field - a public PoC curl command in the GHSA advisory demonstrates the exact invocation. The daemon writes the file verbatim to /tmp/reachy_mini_sounds/<filename> with no inspection, giving the attacker a controlled payload on the robot's filesystem. The attacker then proceeds to exploit separately documented Bluetooth authentication bypass and directory traversal vulnerabilities to execute that payload and achieve root OS access.