Executive brief
The Reachy Mini robot daemon provides an unauthenticated file upload endpoint for sound files that lacks validation, allowing attackers to upload arbitrary file types to the system. This creates a foothold for follow-on attacks and can compromise the integrity of the robot's operating system. When combined with other vulnerabilities in the system's Bluetooth implementation, this can lead to complete root-level compromise of the device.
Technical details
The vulnerability is a CWE-434 unrestricted file upload flaw in the upload_sound() handler in src/daemon/app/routers/media.py. The endpoint accepts file uploads without requiring authentication (PR:N), validates only path traversal using Path.name (which is bypassable), and performs no file extension or magic number validation. Files are written directly to /tmp/reachy_mini_sounds/ where they persist on disk. The daemon binds to 0.0.0.0 with permissive CORS (*), exposing the endpoint to all network interfaces. An attacker can upload executable scripts (.sh) or other dangerous file types (e.g., Python, binary) over the network without authentication. This is part of a documented full compromise chain: the uploaded malicious file serves as a foothold for exploitation via separate Bluetooth vulnerabilities (authentication bypass and directory traversal) to achieve root code execution. The fix requires: (1) authentication enforcement, (2) file extension allowlisting, and (3) content validation via magic numbers. Patched in version 1.8.2.
Affected products
- Pollen Robotics reachy-mini < 1.8.2
Timeline
- 2026-08-25: disclosed
- 2026-06-15: patched: Patched in version 1.8.2