CVE-2026-45225: Heym Path Traversal Vulnerability

CVE-2026-45225 Overview

CVE-2026-45225 is a path traversal vulnerability [CWE-22] in Heym versions before 0.0.21. The flaw exists in the upload_file() handler, where the filename parameter is passed to the storage layer without validation. Authenticated users can supply crafted filenames containing traversal sequences to write, read, or delete files outside the intended storage directory. The issue was patched in release v0.0.21 via pull request #92, which adds path containment checks in backend/app/services/file_storage.py.

Critical Impact
Authenticated attackers can write attacker-controlled files to arbitrary filesystem locations, enabling overwrite of application code, configuration tampering, or staging of follow-on code execution.

Affected Products

Heym versions prior to 0.0.21
Heym backend file upload API (backend/app/api/files.py)
Heym file storage service (backend/app/services/file_storage.py)

Discovery Timeline

2026-05-12 - CVE-2026-45225 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-45225

Vulnerability Analysis

The vulnerability resides in Heym's manual file upload endpoint. The handler accepts a multipart upload and forwards file.filename directly to store_file() without sanitizing path separators or traversal sequences such as ../. Because the storage routine used pathlib.Path joins without containment validation, attacker-supplied filenames could resolve to locations outside the designated upload directory.

Authenticated users on the network can submit a crafted filename to influence where bytes are written on disk. The impact is weighted toward integrity: attackers can overwrite arbitrary files writable by the Heym service account, including application code, templates, or configuration files referenced at runtime.

Root Cause

The root cause is missing validation of the user-controlled filename field in the upload_file() API handler. The fix in pull request #92 introduces explicit path containment using both PurePosixPath and PureWindowsPath to defeat platform-specific traversal payloads, and propagates rejection via ValueError translated to HTTP 400 responses.

Attack Vector

An authenticated user issues a multipart POST to the upload endpoint with a filename value such as ../../etc/heym/config.yaml or a Windows-style ..\..\app\settings.py. The unpatched store_file() resolves the path relative to the storage root without verifying containment, writing the uploaded bytes to the traversed location. No user interaction beyond the attacker's own request is required.

python

# Patched handler in backend/app/api/files.py — pull request #92
    """Upload a file manually to Drive."""
    base_url = build_public_base_url(request)
    file_bytes = await file.read()
    try:
        row = await store_file(
            db,
            owner_id=user.id,
            file_bytes=file_bytes,
            filename=file.filename or "upload",
            mime_type=file.content_type,
            source_node_label="manual upload",
        )
    except ValueError as exc:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
    await create_access_token(db, file_id=row.id, created_by_id=user.id)
    await db.commit()
    await db.refresh(row, ["access_tokens"])
# Source: https://github.com/heymrun/heym/commit/835843e6d2bf7d018cbb8e50f28f0426eaa20c84

python

# Patched storage module in backend/app/services/file_storage.py
import shutil
import uuid
from datetime import datetime, timedelta, timezone
from pathlib import Path, PurePosixPath, PureWindowsPath

import bcrypt
from sqlalchemy import select
# Source: https://github.com/heymrun/heym/commit/835843e6d2bf7d018cbb8e50f28f0426eaa20c84

Detection Methods for CVE-2026-45225

Indicators of Compromise

HTTP multipart upload requests to the Heym files API containing .., ..\\, or URL-encoded %2e%2e%2f sequences in the filename field.
New or modified files owned by the Heym service account outside the configured storage directory.
Unexpected HTTP 400 responses from the upload endpoint after the patch, indicating rejected traversal attempts.

Detection Strategies

Inspect application access logs and reverse proxy logs for upload requests with traversal sequences in Content-Disposition: filename= headers.
Alert on writes by the Heym process to paths outside the documented storage root using filesystem auditing such as auditd or eBPF-based file integrity monitoring.
Correlate authenticated session IDs with anomalous upload filenames to surface insider abuse of valid credentials.

Monitoring Recommendations

Enable verbose logging on the Heym upload endpoint to capture original filename values for forensic review.
Baseline expected file paths under the Heym storage directory and alert on deviation.
Monitor for modifications to Heym application code, configuration, or systemd unit files that could indicate post-exploitation persistence.

How to Mitigate CVE-2026-45225

Immediate Actions Required

Upgrade Heym to version 0.0.21 or later, which contains the fix from pull request #92.
Audit the Heym storage directory and surrounding filesystem for files written outside the intended path since deployment.
Rotate access tokens issued by Heym if traversal activity is suspected, since the upload flow also creates access tokens.

Patch Information

The fix is delivered in Heym v0.0.21 and implemented in commit 835843e merged via pull request #92. The patch adds path containment using PurePosixPath and PureWindowsPath in file_storage.py and surfaces rejection as an HTTP 400 from upload_file(). Refer to the VulnCheck Path Traversal Advisory for additional vendor context.

Workarounds

Restrict access to the Heym upload endpoint to trusted users through network ACLs or reverse proxy authentication until the upgrade is applied.
Run the Heym service under a least-privileged account with write access limited to the storage directory only.
Place a web application firewall rule in front of the upload endpoint to reject multipart filenames containing .., /, or \ characters.

bash

# Example: upgrade Heym and verify the installed version
pip install --upgrade 'heym>=0.0.21'
python -c "import heym; print(heym.__version__)"

# Example NGINX rule to block traversal sequences in upload filenames
# (place inside the relevant location block fronting Heym)
if ($request_body ~* "filename=\"[^\"]*(\.\.[\\/])") {
    return 400;
}