PT-2026-40449 · Heym · Heym

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-45225

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.21

Description Authenticated users can write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. This occurs due to an unvalidated filename parameter in the upload file() handler within the file upload endpoint, allowing attackers to bypass path restrictions to write, read, or delete files outside the intended storage directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to version 0.0.21 or later. As a temporary workaround, restrict access to the upload file() handler to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-45225

Affected Products

Heym

References · 8

• 🔥 https://github.com/heymrun/heym/pull/92 · Exploit
• https://github.com/heymrun/heym/commit/835843e6d2bf7d018cbb8e50f28f0426eaa20c84 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45225 · Security Note
• https://github.com/heymrun/heym/releases/tag/v0.0.21 · Note
• https://twitter.com/CVEnew/status/2054323990999748900 · Twitter Post
• https://vulncheck.com/advisories/heym-path-traversal-file-upload-via-upload-file · Note
• https://t.me/CVEtracker/53566 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054425018705006892 · Twitter Post