HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS
Affects HeyForm versions before 3.0.1, where uploaded HTML files are served as text/html on the app origin with no Content-Security-Policy. Fixed in 3.0.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 3.0.1
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Uploaded HTML is served on the app origin with no Content-Security-Policy because helmet CSP is disabled The bug is reached through the normal file upload flow, which accepts the client-declared Content-Type
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 16/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
HeyForm, an open-source form builder, has a stored cross-site scripting flaw in its file upload handling that lets a logged-in user upload HTML that runs on the HeyForm site when a victim opens the returned link, letting the attacker read or change data available to the victim's account. The attacker reaches it remotely over the network with low-privilege login, and it requires the victim to open the link.
Read the original description
HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.6/10CVSS 7.6
- No patch0/5No signal
What would change the score
- Would score about 66 if added to CISA KEV
- Would score about 61 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Uploaded HTML is served on the app origin with no Content-Security-Policy because helmet CSP is disabled The bug is reached through the normal file upload flow, which accepts the client-declared Content-TypeUpgrade to a fixed version: 3.0.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- heyform heyform
fixed in 3.0.1
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-102615
Is CVE-2026-102615 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Uploaded HTML files are served as text/html on the app's own origin without a Content-Security-Policy. Attacker JavaScript in such a file runs inside the logged-in user's session and can call the GraphQL API as that user to read or change data the account can access.Source: github.com, github.com
Which versions are affected by CVE-2026-102615?
heyform: before 3.0.1.Source: cve.now feed data
Am I affected, and how do I check?
Versions before 3.0.1 are affected in the setup where helmet has contentSecurityPolicy set to false in main.ts. To check, look at the HeyForm version you run and at that setting in main.ts.Source: github.com, github.com
How do I fix CVE-2026-102615?
Upgrade to HeyForm 3.0.1, which is the fixed version listed in the advisory. No workaround is listed in the sources.Source: github.com, github.com
Why do the sources disagree?
The description says the bug can be reached without authentication, while the CVSS vector records PR:L, meaning low privileges are required. The sources conflict on this point and do not resolve it.Source: github.com, github.com