Yuvalmo-Jfrog

**Name of the Vulnerable Software and Affected Versions** Reachy Mini versions prior to 1.8.2 **Description** The Reachy Mini daemon exposes the '/api/media/sounds/upload' endpoint, implemented by the `upload sound()` function, without authentication, file-extension checks, content validation, or size validation. By default, the daemon binds to 0.0.0.0 and uses permissive CORS (Cross-Origin Resource Sharing) settings, allowing an unauthenticated network attacker to upload arbitrary file types to the `/tmp/reachy mini sounds/<original filename>` directory. This can compromise stored-data integrity and serve as a foothold for further attacks, such as gaining root access when combined with other issues like Bluetooth authentication bypass and directory traversal. **Recommendations** Update to version 1.8.2. As a temporary workaround, restrict network access to the '/api/media/sounds/upload' endpoint to minimize the risk of exploitation.