Attack Chain

1. Attacker authenticates to the Heym application.
2. Attacker crafts a malicious filename containing path traversal sequences (e.g., ../../../evil.php).
3. Attacker initiates a file upload request to the upload_file() endpoint, including the crafted filename.
4. The upload_file() handler receives the request but fails to properly sanitize the filename.
5. The application writes the uploaded file to a location outside the intended directory, based on the path provided in the crafted filename.
6. The attacker triggers execution of the uploaded file (e.g. if it’s a PHP file).
7. The attacker achieves arbitrary code execution on the server.

Impact

Successful exploitation of this vulnerability allows an attacker to write, read, or delete files outside the intended storage directory. This can lead to arbitrary code execution, allowing the attacker to gain complete control over the affected system. The CVSS v3.1 base score for this vulnerability is 7.6 (High), indicating a significant risk. The potential impact includes unauthorized access to sensitive data, modification of critical system files, and complete system compromise.

Recommendation

• Upgrade Heym to version 0.0.21 or later to patch CVE-2026-45225.
• Implement robust filename validation and sanitization within the upload_file() handler to prevent path traversal attacks.
• Deploy the Sigma rule Detect Heym Path Traversal File Upload (CVE-2026-45225) to detect exploitation attempts in web server logs.
• Monitor web server logs for HTTP requests to the file upload endpoint containing suspicious filename patterns.