CVE-2026-102615: HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS
HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HeyFormto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk?
An ordinary authenticated HeyForm user can upload active HTML and induce a victim to open the returned upload URL. The victim's account is at risk because the script runs on the HeyForm origin and can access or modify data available through that victim's session.
Is an unauthenticated attack path confirmed?
The code permits upload requests associated with an active public form using formId, openToken, and a file or signature fieldId. However, the advisory did not fully verify this unauthenticated path end to end.
What version fixes the vulnerability?
The issue is fixed in HeyForm version 3.0.1. Versions prior to 3.0.1 are affected.