CVE-2026-63429
Received Received - Intake

Arbitrary File Upload in HeyForm

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters; because no form-context binding exists, every request to it is anonymously accepted. Version 3.0.0-rc.9 contains a patch for the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63429
EUVD
EUVD-2026-45986

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
heyform heyform to 3.0.0-rc.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in HeyForm (versions before 3.0.0-rc.9) allows unauthenticated users to upload any file type (up to 10 MB) via the /api/upload endpoint without checks for authentication, session, or form context. The endpoint returns a permanent public URL on HeyForm's domain, enabling attackers to misuse the service as a free file hosting platform.

Detection Guidance

Check for unauthorized file uploads to the /api/upload endpoint by monitoring network traffic for POST requests to this path. Look for responses containing HeyForm domain URLs (e.g., heyform.net) hosting unexpected file types. Inspect server logs for repeated uploads from unknown IPs or unusual file extensions.

Impact Analysis

Attackers could upload malicious files (e.g., phishing payloads, malware) to HeyForm's infrastructure, which may be used in further attacks. The service could also face storage exhaustion due to excessive uploads, disrupting legitimate use. Users interacting with uploaded files may be exposed to security risks.

Compliance Impact

This vulnerability could lead to unauthorized data storage or exposure, violating GDPR's data protection principles (e.g., integrity, confidentiality) or HIPAA's requirements for safeguarding protected health information. Organizations using affected HeyForm versions may face compliance violations.

Mitigation Strategies

Upgrade HeyForm to version 3.0.0-rc.9 or later to apply the patch. If upgrading is not immediately possible, restrict access to the /api/upload endpoint via firewall rules or disable it entirely. Implement authentication checks and form-context validation for all upload requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart