CVE-2026-55419

MediumCVSS 5.3

Published: 25/08/2026(UTC)Updated: 09/09/2026(UTC)Translated: 26/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Reachy Mini SDK before version 1.8.2 exposes the /api/media/sounds/upload endpoint without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS, allowing an unauthenticated attacker to upload arbitrary files to /tmp/reachy_mini_sounds/. This issue is fixed in version 1.8.2.

Risk Assessment

An attacker can compromise stored-data integrity and gain a foothold for further attacks on the network.

Recommendation

Update Reachy Mini to version 1.8.2 or later and restrict access to the endpoint via firewall.

Other vulnerabilities in Reachy Mini

CVE-2026-96456Medium
The Reachy Mini Bluetooth service asks for a PIN before accepting commands, but the authenticated state is shared across all devices, allowing an attacker in Bluetooth range to ride on someone else's successful authentication without knowing the PIN.

Original NVD description (English source)

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the upload_sound method in src/reachy_mini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS allow_origins=["*"], allowing an unauthenticated network attacker to upload arbitrary file types that are written to /tmp/reachy_mini_sounds/<original_filename>. Malicious files can compromise stored-data integrity and can serve as a foothold when combined with other vulnerabilities. This issue is fixed in version 1.8.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS