CVE-2026-55419
Received Received - Intake

Unauthenticated File Upload in Reachy Mini SDK

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the upload_sound method in src/reachy_mini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS allow_origins=["*"], allowing an unauthenticated network attacker to upload arbitrary file types that are written to /tmp/reachy_mini_sounds/<original_filename>. Malicious files can compromise stored-data integrity and can serve as a foothold when combined with other vulnerabilities. This issue is fixed in version 1.8.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55419
EUVD
EUVD-2026-65627

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
reachy_mini reachy_mini to 1.8.2 (inc)
pollen-robotics reachy_mini 1.8.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to version 1.8.2, the daemon exposes an endpoint /api/media/sounds/upload without authentication, file-extension checks, content validation, or size validation. This allows unauthenticated attackers to upload arbitrary files to /tmp/reachy_mini_sounds/<original_filename>.

Detection Guidance

Check if the Reachy Mini daemon is running on port 0.0.0.0 by using commands like 'netstat -tulnp | grep 0.0.0.0' or 'ss -tulnp | grep 0.0.0.0'. Look for the /api/media/sounds/upload endpoint in logs or network traffic. Verify if files are being written to /tmp/reachy_mini_sounds/

Impact Analysis

An attacker could upload malicious files that compromise stored-data integrity or serve as a foothold for further attacks. The daemon binds to 0.0.0.0 by default with permissive CORS, making it accessible from any network.

Compliance Impact

The vulnerability allows unauthenticated file uploads without validation, which could lead to unauthorized code execution or data tampering. This could violate GDPR's integrity principle (Article 5) or HIPAA's integrity and security requirements by compromising stored data or enabling further attacks.

Mitigation Strategies

Upgrade Reachy Mini to version 1.8.2 or later. If upgrading is not immediately possible, restrict network access to the daemon by binding it to localhost only or using a firewall. Disable permissive CORS settings and implement authentication for the /api/media/sounds/upload endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55419. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart