File Upload Vulnerability in HeyForm Open-Source Form Builder
CVE-2026-102615

7.6HIGH

Key Information:

Vendor

Heyform

Status
Heyform
Vendor
CVE Published:
5 November 2026

What is CVE-2026-102615?

A file upload vulnerability exists in HeyForm, an open-source form builder, prior to version 3.0.1. This issue allows an attacker to upload malicious HTML files, which are then served as text/html. When a victim opens the URL linked to the uploaded file, the HTML executes within the HeyForm origin. This further enables an attacker to access sensitive GraphQL endpoints, thereby compromising user sessions and allowing unauthorized data access or manipulation. The issue can be triggered through an active public form via specific identifiers, although complete unauthenticated access was not fully verified. The vulnerability was resolved in version 3.0.1.

Affected Version(s)

heyform < 3.0.1

References

https://github.com/heyform/heyform/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/heyform/heyform/commit/849f7101d4370b2...
x_refsource_MISC
https://github.com/heyform/heyform/releases/tag/v3.0.1
x_refsource_MISC

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.