Executive brief
HeyForm, an open-source form builder, contains a security flaw that allows any anonymous internet user to upload files to the server without a password or session. Attackers can use this to host malicious files on a legitimate-looking domain for phishing or to exhaust the server's storage capacity. This could lead to service outages or reputational damage if the platform is used to distribute malware.
Technical details
The `UploadController` in HeyForm lacks authentication decorators (such as `@UseGuards()`) on the `/api/upload` endpoint, and the application does not implement global guards or form-context validation for this route. This allows unauthenticated remote attackers to upload arbitrary files (up to 10MB) including PDFs, Office documents, and media files. Upon successful upload, the server returns a permanent public URL. This vulnerability can be exploited for unauthorized file hosting, phishing campaigns, or storage exhaustion (denial of service). The issue is fixed in version 3.0.0-rc.9 by hardening the form security surfaces.
Affected products
- HeyForm HeyForm < 3.0.0-rc.9
Timeline
- 2026-06-25: patched: Fix commit pushed to repository
- 2026-07-01: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published in NVD