CVE-2026-45225
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A path traversal vulnerability in Heym before version 0.0.21 allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. The flaw exists in the file upload endpoint where the filename parameter is not properly validated.
Risk Assessment
Attackers can bypass path restrictions and write, read, or delete files outside the intended storage directory, potentially leading to server compromise or data exfiltration.
Recommendation
Immediately upgrade Heym to version 0.0.21 or later, which includes a fix for this vulnerability. Additionally, implement server-side filename validation.
Other vulnerabilities in Heym
See all- CVE-2026-45227High
Heym before version 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor. Authenticated workflow authors can bypass sandbox restrictions using object-graph introspection primitives.
- CVE-2026-45226High
Heym before version 0.0.21 contains an authorization bypass vulnerability in workflow execution. An authenticated attacker can execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation.
Original NVD description (English source)
Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.