HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…eyform/security/advisories/GHSA-pxw5-pjrc-j758 Diğer
• github.com/…ommit/849f7101d4370b29e716b2d7ee14a86c2f598f3a Diğer
• github.com/heyform/heyform/releases/tag/v3.0.1 Diğer

Kayıt geçmişi

1. 5 Kas 2026 18:32Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-75599HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields
• 5,4 CVE-2026-123094Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name
• 10,0 CVE-2026-96677Apache Juneau HTML belge şablonunda istek değişkenleri nedeniyle siteler arası betik çalıştırma (XSS)
• 5,4 CVE-2026-117679A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitr…
• 6,4 CVE-2026-104812Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key
• 6,4 CVE-2026-120533Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile