CVE-2026-45225: Heym < 0.0.21 Path Traversal File Upload via upload_file()
Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the uploadfile() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heymto a version that resolves this vulnerability.Fixed in 0.0.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45225?
CVE-2026-45225 is considered a high severity vulnerability due to its potential to allow unauthorized file access and execution.
How do I fix CVE-2026-45225?
To fix CVE-2026-45225, users should upgrade to Heym version 0.0.21 or later, which addresses the path traversal vulnerability.
Who is affected by CVE-2026-45225?
CVS-2026-45225 affects all users of Heym versions prior to 0.0.21 who utilize the file upload functionality.
What kind of attacks are possible with CVE-2026-45225?
With CVE-2026-45225, authenticated users can exploit the vulnerability to upload files to arbitrary locations on the server.
Is there a workaround for CVE-2026-45225?
While the best solution is to update to version 0.0.21 or higher, disabling the file upload feature temporarily can serve as a workaround.