EUVD-2026-45986Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Remote unauthenticated, no interaction (AV:N/AC:L/PR:N/UI:N); no data disclosure so C:N, impact is unauthorized file injection/hosting (I:L) and storage exhaustion (A:L), not RCE.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters; because no form-context binding exists, every request to it is anonymously accepted. Version 3.0.0-rc.9 contains a patch for the issue.
AnalysisAI
Missing authentication in HeyForm's POST /api/upload endpoint lets any anonymous internet user upload files up to 10 MB (PDF, Office docs, CSV, MP4, images, etc.) and receive a permanent, public URL hosted on the HeyForm domain. The endpoint is shared by authenticated form creators and unauthenticated submitters but performs no auth guard, no form-context binding, no openToken check, and no session validation, so every request is accepted anonymously in all deployments prior to 3.0.0-rc.9. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; abuse is trivial but limited to unauthorized file hosting rather than server compromise.
Technical ContextAI
HeyForm is a self-hostable open-source online form/survey builder (Node.js/TypeScript server with a Multer-based upload pipeline that stores files either to an S3-compatible bucket or to local disk). The root cause is CWE-306 (Missing Authentication for a Critical Function): the file-upload route is mounted without the application's authentication middleware, global guard, or the openToken/form-context checks that legitimate submission flows are supposed to enforce. Because uploads must work for anonymous form respondents, the developers left the endpoint open, but they never bound a request to a specific form or submission session, so the same handler that serves genuine form file-answers also acts as an unauthenticated, general-purpose object store. The affected component is cpe:2.3:a:heyform:heyform (all versions before 3.0.0-rc.9). Note that the remediation commit (092e255e) also bundles unrelated hardening - stricter unsafe-URL-protocol sanitization against javascript:/vbscript:/data: XSS split by control characters, and an assertSafeOutboundRequest SSRF guard - but those are separate defenses, not the subject of this CVE.
RemediationAI
Vendor-released patch: 3.0.0-rc.9 - upgrade to HeyForm 3.0.0-rc.9 or later, which adds proper guarding/context binding to the upload flow (fix commit https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2; advisory https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7). If you cannot upgrade immediately, front the instance with a reverse proxy or WAF rule that requires a valid form-submission context (origin/referrer from a real published form) before allowing POST /api/upload, or restrict the endpoint to authenticated sessions - with the trade-off that anonymous public form submissions containing file-upload fields will break. Additional compensating controls: enforce strict per-IP rate limiting and a small maximum file count on the endpoint to blunt storage-exhaustion abuse, serve uploaded objects from a separate throwaway domain/bucket so blocklisting cannot taint your primary domain, and monitor upload volume and object types for anomalous binaries. Each of these reduces abuse but does not fully close the authentication gap, so upgrading remains the primary fix.
Stored cross-site scripting in HeyForm's form builder (all versions prior to 3.0.0-rc.7) lets a low-privileged team memb
Cross-origin credential exposure in HeyForm before 3.0.0-rc.8 allows any attacker-controlled web page visited by a logge
Stored cross-site scripting in HeyForm's unauthenticated file upload endpoint allows remote attackers to execute arbitra
Hidden field injection in HeyForm's form submission API allows anonymous submitters to bypass server-side schema validat
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today