Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102615— HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS

Quick assessment

Affected
heyform heyform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HeyForm 是一个开源的表单构建工具。在 3.0.1 版本之前，其 接口会依据客户端控制的 参数接收文件，同时保留原始 HTML 文件名；而静态资源服务 会将上传后的文件以 内容类型返回，并禁用内容安全策略（ ）。因此，普通用户可上传包含可执行内容的活动 HTML 文件；当受害者访问该文件返回的 URL 时，恶意脚本将在 HeyForm 的源站上下文中执行。由于同源策略，该脚本能够利用受害者的会话访问 接口，进而读取或修改该账户可访问的数据。 此外，代码还允许通过 、 以及属于文件上传或签名问题的 ，对已激活的

CVSS 7.6 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102615

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS
Source: CVE Program / CVE List V5
Vulnerability Description
HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
heyform heyform < 3.0.1 -

II. Public POCs for CVE-2026-102615

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102615

请登录查看更多情报信息。

Other References for CVE-2026-102615 (3)

IV. Related Vulnerabilities

Same product: heyform
Same vendor: heyform
Same weakness: CWE-79