Unauthorized File Upload Vulnerability in Reachy Mini SDK by Pollen Robotics

CVE-2026-55419

What is CVE-2026-55419?

The Reachy Mini SDK is vulnerable due to an unprotected /api/media/sounds/upload endpoint, which allows unauthenticated attackers to upload files without any validation. This includes lacking checks for file extensions, content integrity, and size limits. The daemon, by default, binds to 0.0.0.0 and is configured with permissive CORS settings, enabling potential exploitation by malicious actors. The uploaded files can be malicious, compromising the integrity of stored data and potentially aiding further attacks. This vulnerability has been addressed in version 1.8.2 of the software, which enhances security measures to prevent unauthorized access.

References