Reachy Mini: Unrestricted Upload of File with Dangerous Type
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.
Summary
Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the upload_sound method in src/reachy_mini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS allow_origins=["*"], allowing an unauthenticated network attacker to upload arbitrary file types that are written to /tmp/reachy_mini_sounds/<original_filename>. Malicious files can compromise stored-data integrity and can serve as a foothold when combined with other vulnerabilities. This issue is fixed in version 1.8.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pollen Robotics | reachy_mini | before 1.8.2 | 1.8.2 | Patch available | CNA |
| — | reachy-mini (PyPI) | before 1.8.2 | 1.8.2 | Patch available | GHSA-m2pc-3q4q-w6jr |
- reachy_mini VendorPollen Robotics Affected before 1.8.2 Fixed in 1.8.2 Patch available CNA
- reachy-mini (PyPI) Vendor— Affected before 1.8.2 Fixed in 1.8.2 Patch available GHSA-m2pc-3q4q-w6jr
Remediation
- Fix · CNA reachy_mini (pollen-robotics) Fixed in 1.8.2
- Fix · GHSA-m2pc-3q4q-w6jr reachy-mini (PyPI) Fixed in 1.8.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55419
- 2026-10-03 Alias added: GHSA-m2pc-3q4q-w6jr
References
Other 5
- https://github.com/pollen-robotics/reachy_mini/security/advisories/GHSA-m2pc-3q4q-w6jr
- https://github.com/pollen-robotics/reachy_mini/pull/1209
- https://github.com/pollen-robotics/reachy_mini/commit/984c7723b3ec5da63f4e0a2bcf9f120ceb563e04
- https://github.com/pollen-robotics/reachy_mini/releases/tag/v1.8.2
- https://github.com/pollen-robotics/reachy_mini
More Pollen Robotics vulnerabilities
- TI-2026-63787 Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint CVSS 3.1HIGH 8.8
- TI-2026-38661 Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant CVSS 3.1HIGH 7.8
- TI-2026-63788 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device CVSS 3.1MEDIUM 6.3
Sources
- CVE-2026-55419 · CVE Program
- CVE-2026-55419 · NVD
- FIRST EPSS
- GHSA-m2pc-3q4q-w6jr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences