CVE-2026-55419

creationtimestamp| type| source ---|---|--- 2026-08-25 18:35:03+00:00| published-proof-of-concept| https://github.com/pollen-robotics/reachymini/security/advisories/GHSA-m2pc-3q4q-w6jr 2026-08-26 13:31:41+00:00| seen| https://gist.github.com/alon710/d4e64579bb9348b8491cca97afa7743d...

GHSA-M2PC-3Q4Q-W6JR reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

EUVD-2026-65627

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...