EUVD-2026-45986Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify public HeyForm instance
-
ExploitSend anonymous POST /api/upload with file
-
ExecutionReceive permanent public URL on HeyForm domain
-
ImpactDistribute malicious/phishing links or exhaust storage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is network reachability to a HeyForm instance older than 3.0.0-rc.9 that exposes POST /api/upload - no authentication, session cookie, openToken, form context, or user interaction is required, matching AV:N/AC:L/PR:N/UI:N against default configurations. Limiting factors are minimal: exploitation is bounded to the 10 MB per-file size cap and to instances that are internet-reachable, and impact is confined to uploading files and obtaining public hosting URLs rather than executing code or reading existing data. Instances not exposed to untrusted networks (internal-only, IP-allowlisted, or fronted by an auth-enforcing proxy) are not practically exploitable. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, base 8.6) correctly reflects trivial, remote, unauthenticated, no-interaction exploitation, and PR:N confirms no authentication is required. However, the I:H rating appears aggressive: the real-world impact is unauthorized file storage/hosting on a trusted domain, not server-side integrity compromise or code execution - the description shows no RCE, path traversal, or overwrite of existing objects, so my independent read is closer to I:L/A:L (see assessed vectors). No EPSS score, KEV listing, or POC was provided, so treat exploitation as plausible-and-easy but not observed. The practical risk is abuse as free/anonymous file hosting: malware and phishing payload distribution under the HeyForm domain's reputation, storage-cost and quota exhaustion, and potential domain/IP blocklisting. This is a genuine priority for anyone running a publicly reachable HeyForm instance (reputation and cost exposure), but it is not a critical server-takeover bug despite the 8.6 headline score. |
| Exploit ScenarioDerived | An attacker scripts repeated anonymous POST requests to /api/upload on a public HeyForm instance, uploading malware installers or phishing HTML/PDFs and receiving permanent public URLs on the victim's HeyForm domain. They then distribute those trusted-looking links in phishing campaigns and reuse the instance as free anonymous CDN hosting; because AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special tooling are needed and the abuse is easily automated. No public POC was provided, but the attack is straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 20, 2026
Missing authentication in HeyForm's POST /api/upload endpoint lets any anonymous internet user upload files up to 10 MB (PDF, Office docs, CSV, MP4, images, etc.) and receive a permanent, public URL hosted on the HeyForm domain. The endpoint is shared by authenticated form creators and unauthenticated submitters but performs no auth guard, no form-context binding, no openToken check, and no session validation, so every request is accepted anonymously in all deployments prior to 3.0.0-rc.9. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; abuse is trivial but limited to unauthorized file hosting rather than server compromise.
RemediationAI
Vendor-released patch: 3.0.0-rc.9 - upgrade to HeyForm 3.0.0-rc.9 or later, which adds proper guarding/context binding to the upload flow (fix commit https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2; advisory https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7). If you cannot upgrade immediately, front the instance with a reverse proxy or WAF rule that requires a valid form-submission context (origin/referrer from a real published form) before allowing POST /api/upload, or restrict the endpoint to authenticated sessions - with the trade-off that anonymous public form submissions containing file-upload fields will break. Additional compensating controls: enforce strict per-IP rate limiting and a small maximum file count on the endpoint to blunt storage-exhaustion abuse, serve uploaded objects from a separate throwaway domain/bucket so blocklisting cannot taint your primary domain, and monitor upload volume and object types for anomalous binaries. Each of these reduces abuse but does not fully close the authentication gap, so upgrading remains the primary fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HeyForm is a self-hostable open-source online form/survey builder (Node.js/TypeScript server with a Multer-based upload pipeline that stores files either to an S3-compatible bucket or to local disk). The root cause is CWE-306 (Missing Authentication for a Critical Function): the file-upload route is mounted without the application's authentication middleware, global guard, or the openToken/form-context checks that legitimate submission flows are supposed to enforce. Because uploads must work for anonymous form respondents, the developers left the endpoint open, but they never bound a request to a specific form or submission session, so the same handler that serves genuine form file-answers also acts as an unauthenticated, general-purpose object store. The affected component is cpe:2.3:a:heyform:heyform (all versions before 3.0.0-rc.9). Note that the remediation commit (092e255e) also bundles unrelated hardening - stricter unsafe-URL-protocol sanitization against javascript:/vbscript:/data: XSS split by control characters, and an assertSafeOutboundRequest SSRF guard - but those are separate defenses, not the subject of this CVE.
Know when Heyform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Remote unauthenticated, no interaction (AV:N/AC:L/PR:N/UI:N); no data disclosure so C:N, impact is unauthorized file injection/hosting (I:L) and storage exhaustion (A:L), not RCE.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters; because no form-context binding exists, every request to it is anonymously accepted. Version 3.0.0-rc.9 contains a patch for the issue.
Executive ViewAI
HeyForm before version 3.0.0-rc.9 allows unauthenticated file uploads up to 10 MB with permanent public URLs on your domain, enabling unauthorized data hosting and infrastructure abuse. This affects all unpatched deployments and creates reputational risk through potential misuse for phishing or malware distribution.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stored cross-site scripting in HeyForm's form builder (all versions prior to 3.0.0-rc.7) lets a low-privileged team memb
Cross-origin credential exposure in HeyForm before 3.0.0-rc.8 allows any attacker-controlled web page visited by a logge
Stored cross-site scripting in HeyForm's unauthenticated file upload endpoint allows remote attackers to execute arbitra
Hidden field injection in HeyForm's form submission API allows anonymous submitters to bypass server-side schema validat
Exploit-DB