CVE-2026-55419

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

PT-2026-53689

Name of the Vulnerable Software and Affected Versions Reachy Mini ISO for Wireless versions prior to 0.2.4 Description The Reachy Mini Wireless OS image contains an overly broad sudoers entry that grants the pollen daemon user uid 1000 passwordless sudo access to the /usr/bin/systemctl endpoint...