PT-2026-61623 · Heyform · Heyform

CVE-2026-63429 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions HeyForm versions prior to 3.0.0-rc.9

Description An authentication bypass exists in the open-source form builder. The endpoint POST /api/upload lacks an authentication guard, global guard, form-context validation, openToken requirement, and session cookie checks. This allows any anonymous internet user to upload files—including PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, and images up to 10 MB—and obtain a permanent public URL on the domain. The issue occurs because the endpoint is used by both authenticated creators and unauthenticated submitters, but lacks form-context binding, causing every request to be accepted anonymously.

Recommendations Update to version 3.0.0-rc.9. Restrict access to the POST /api/upload endpoint to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Missing Authentication

Weakness Enumeration

CWE-434

CWE-306

Related Identifiers

CVE-2026-63429

GHSA-432X-54V2-P7P7

Affected Products

Heyform

References · 7

• 🔥 https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63429.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-63429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-63429 · Security Note
• https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2 · Note
• https://twitter.com/HugoValters/status/2079266161976348757 · Twitter Post
• https://twitter.com/CVEnew/status/2079238902489956672 · Twitter Post