Read the docs
TI-2026-85482 Aliases CVE-2026-102615

Stored cross-site scripting in HeyForm via uploaded HTML files

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

HeyForm, an open-source form builder, is affected before 3.0.1. Its upload handler trusts the client-supplied MIME type and serves uploaded HTML files as text/html on the application origin without a Content Security Policy. An ordinary user can upload active HTML (CWE-79) that runs script when a victim opens the returned URL, and that script can use the victim's session to read or modify data available to the account.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.

Why it matters now

EPSS 0.00252 16th percentileScored 2026-11-07
Fix Fixed heyform (heyform): 3.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
heyformheyformbefore 3.0.13.0.1Patch availableCNA
  • heyform Vendorheyform Affected before 3.0.1 Fixed in 3.0.1 Patch available CNA

Remediation

Upgrade HeyForm to version 3.0.1, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA heyform (heyform) Fixed in 3.0.1

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-102615
  2. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-45208 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context CVSS 3.1HIGH 8.6
  • TI-2026-27351 HeyForm vulnerable to stored XSS via form field titles CVSS 3.1CRITICAL 9.0
  • TI-2026-56756 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials CVSS 3.1HIGH 8.1
  • TI-2026-45207 Improper input validation in heyform CVSS 3.1MEDIUM 5.8
  • TI-2026-33532 HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload CVSS 4.0MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences