Lucene search
+L

6 matches found

NVD
NVD
added 2026/08/25 6:17 p.m.9 views

CVE-2026-55419

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

5.3CVSS0.00339EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/25 5:38 p.m.10 views

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

5.3CVSS5.8AI score0.00339EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2026/08/25 5:34 p.m.15 views

CVE-2026-55419

Reachy Mini (an SDK by Pollen Robotics for controlling Reachy Mini robots) prior to 1.8.2 exposes the /api/media/sounds/upload endpoint without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS (allow_ori...

5.3CVSS5.6AI score0.00339EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/25 5:34 p.m.31 views

CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

5.3CVSS0.00339EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/25 5:34 p.m.9 views

CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

5.3CVSS5.8AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.17 views

PT-2026-81446

Name of the Vulnerable Software and Affected Versions Reachy Mini versions prior to 1.8.2 Description The Reachy Mini daemon exposes the '/api/media/sounds/upload' endpoint, implemented by the upload sound function, without authentication, file-extension checks, content validation, or size...

5.3CVSS5.6AI score0.00339EPSS
SaveExploits0References14
Rows per page
Query Builder