PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55419 pollen-robotics CVE debrief

CVE-2026-55419 is a vulnerability in the Reachy Mini SDK that allows unauthenticated file uploads. The issue is fixed in version 1.8.2. This vulnerability compromises stored-data integrity and can serve as a foothold for further attacks when combined with other vulnerabilities. Defenders should assess exposure and prioritize upgrading to version 1.8.2 or later. Verification of file upload restrictions and content validation is required. Inventory checks for Reachy Mini SDK deployments are necessary.

Vendor
pollen-robotics
Product
reachy_mini
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-09-09
Advisory published
2026-08-25
Advisory updated
2026-09-09

Who should care

Defenders responsible for Reachy Mini SDK deployments should assess exposure and prioritize upgrading to version 1.8.2 or later. They should also verify file upload restrictions and content validation, and perform inventory checks for Reachy Mini SDK deployments.

Why it matters

CVE-2026-55419 allows unauthenticated file uploads in Reachy Mini SDK, compromising stored-data integrity and potentially serving as a foothold for further attacks. Defenders should prioritize verification and upgrading to version 1.8.2 or later.

  • Unauthenticated file uploads can compromise stored-data integrity
  • Malicious files can serve as a foothold when combined with other vulnerabilities
  • Verification of file upload restrictions and content validation is required
  • Inventory checks for Reachy Mini SDK deployments are necessary

Technical summary

The Reachy Mini daemon exposes the /api/media/sounds/upload endpoint without authentication, file-extension checks, content validation, or size validation. This allows an unauthenticated network attacker to upload arbitrary file types that are written to /tmp/reachy_mini_sounds/<original_filename>. The vulnerability compromises stored-data integrity and can serve as a foothold for further attacks when combined with other vulnerabilities. Defenders should prioritize verifying and upgrading to version 1.8.2 or later.

Defensive priority

Defenders should prioritize verifying and upgrading to version 1.8.2 or later.

Recommended defensive actions

  • Verify and upgrade to version 1.8.2 or later
  • Review and restrict access to the /api/media/sounds/upload endpoint
  • Monitor for suspicious file uploads
  • Perform inventory checks for Reachy Mini SDK deployments
  • Verify file upload restrictions and content validation
  • Review compensating controls for exposed systems
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional information may be needed to fully assess the impact, including verification of file upload restrictions and content validation. The vulnerability allows unauthenticated network attackers to upload arbitrary file types written to /tmp/reachy_mini_sounds/<original_filename>.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55419 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55419

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55419 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55419

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.