CVE-2026-102615

Name of the Vulnerable Software and Affected Versions HeyForm versions prior to 3.0.1

Description An issue exists where the '/api/upload' endpoint accepts files based on a client-controlled multipart file.mimetype while keeping an HTML filename. The 'static/upload' endpoint then serves these files as 'text/html' with the content security policy disabled. This allows a user to upload active HTML that executes on the HeyForm origin when accessed by a victim. Such scripts can interact with the '/graphql' endpoint using the victim's session to read or modify account data. Additionally, upload requests may be possible via active public forms using the formId, openToken, and fieldId variables associated with file or signature questions.

Recommendations Update to version 3.0.1.