CVE-2026-102615 Details
Description
HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.
A stored cross-site scripting vulnerability has been identified in HeyForm, an open-source form builder, in versions prior to 3.0.1. The issue arises in the file upload API, which accepts files based on the client-controlled multipart file mimetype while preserving an HTML filename. The uploaded file is then served as text/html without a Content Security Policy, allowing any active HTML to execute on the HeyForm origin when the URL is accessed. This exploitation can be done by ordinary users, and the executed script can interact with the GraphQL API using the victim's session, potentially leading to unauthorized data access or modification.
Users can update to HeyForm version 3.0.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/heyform/heyform/commit/849f7101d4370b29e716b2d7ee14a86c2f598f3a | [email protected] | Source CodeVendor |
| https://github.com/heyform/heyform/releases/tag/v3.0.1 | [email protected] | Release NotesVendor |
| https://github.com/heyform/heyform/security/advisories/GHSA-pxw5-pjrc-j758 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HeyForm | <= 3.0.0-rc.10 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |