Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-45225 Path Traversal in Heym Before 0.0.21 File Upload Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45225
Post summary
The post discloses CVE‑2026‑45225 as a path traversal flaw in Heym’s file upload endpoint, without mentioning PoC, exploit code, or active exploitation.
CVE-2026-45225 Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary… https://www.cve.org/CVERecord?id=CVE-2026-45225
Post summary
CVE-2026-45225 is a path traversal flaw in Heym versions prior to 0.0.21 that permits authenticated users to write arbitrary files via the upload endpoint.