PatchSiren cyber security CVE debrief
CVE-2026-63429 heyform CVE debrief
CVE-2026-63429 is an unauthenticated file upload vulnerability in HeyForm, an open-source form builder. The vulnerability exists in the `POST /api/upload` endpoint, which lacks authentication, global guards, form-context validation, `openToken` requirements, and session cookie checks. This allows any anonymous internet user to upload files, including PDFs, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, and images, up to 10 MB, and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters, and every request to it is anonymously accepted due to the lack of form-context binding. Version 3.0.0-rc.9 contains a patch for the issue.
- Vendor
- heyform
- Product
- Unknown
- CVSS
- HIGH 8.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-20
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-20
Who should care
Users of HeyForm, an open-source form builder, should be aware of this vulnerability and take immediate action to protect their applications. This vulnerability allows unauthenticated file uploads, which can lead to security risks such as malware distribution, data breaches, and unauthorized access.
Technical summary
The vulnerability exists in the `POST /api/upload` endpoint of HeyForm, an open-source form builder. The endpoint lacks authentication, global guards, form-context validation, `openToken` requirements, and session cookie checks. This allows any anonymous internet user to upload files and receive a permanent public URL on the HeyForm domain. The CVSS score for this vulnerability is 8.6, indicating a high severity level.
Defensive priority
High
Recommended defensive actions
- Upgrade to version 3.0.0-rc.9 or later
- Implement authentication and authorization for file uploads
- Validate file types and sizes before uploading
- Use a Web Application Firewall (WAF) to detect and prevent suspicious traffic
- Monitor for suspicious activity and implement incident response plans
Evidence notes
The CVE record was published on 2026-07-20T16:17:06.810Z and was last modified on 2026-07-20T18:16:56.170Z. The NVD entry is currently in the 'Received' status. The vulnerability is described in the CVE record and the NVD detail page.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T16:17:06.810Z and has not been modified since then. The NVD entry is currently Received.