CVE-2026-45797

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.

• CWE-79
• CWE-434

• https://github.com/heyform/heyform/commit/144240e5545d10fd9e120d05ccb402a6d7064674
• https://github.com/heyform/heyform/security/advisories/GHSA-m94h-jxvc-hhch

Published

Jul 20, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45791Dokploy is a free, self-hostable Platform as a Service (PaaS…5.9
• CVE-2026-45792rtk filters and compresses command outputs before they reach…5.5
• CVE-2026-45793Composer is a dependency Manager for the PHP language. Prior…7.5
• CVE-2026-45794Open Access Management (OpenAM) is an access management solu…7.7
• CVE-2026-45795The Janssen Project is an open-source identity and access ma…5.3
• CVE-2026-45796Coder allows organizations to provision remote development e…6.5
• CVE-2026-45798Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-45799Wire provides gRPC and protocol buffers for Android, Kotlin,…7.5
• CVE-2026-4580A security flaw has been discovered in code-projects Simple …9.8
• CVE-2026-45800Vvveb is a powerful and easy to use CMS with page builder to…8.7
• CVE-2026-45802FPDI is a collection of PHP classes that facilitate reading …6
• CVE-2026-45803`gh` is GitHub’s official command line tool. From 1.6.0 to b…3.5