CVE-2026-63429
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in HeyForm before version 3.0.0-rc.9: the POST /api/upload endpoint lacks authentication and form-context validation. Any anonymous user can upload a file (up to 10 MB) and receive a public URL.
Risk Assessment
Attackers can store arbitrary files on the HeyForm domain, potentially used for hosting malicious content or data leakage.
Recommendation
Update HeyForm to version 3.0.0-rc.9 or later, which contains the fix.
Other vulnerabilities in HeyForm
See all- CVE-2026-35198Critical
HeyForm prior to version 3.0.0-rc.7 contains a stored XSS vulnerability in the form builder. A low-privileged team member can inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation.
- CVE-2026-82291High
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
- CVE-2026-63428Medium
HeyForm before version 3.0.0-rc.9 does not properly validate `hiddenFields` submitted by users. An anonymous user can inject arbitrary key-value pairs, including XSS payloads, which are then forwarded to webhooks.
- CVE-2026-45797Medium
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.
Original NVD description (English source)
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters; because no form-context binding exists, every request to it is anonymously accepted. Version 3.0.0-rc.9 contains a patch for the issue.