Medium, CVSS 5.3PyPIPublished
reachy_mini Allows Unrestricted Upload of File with Dangerous Type
CVE-2026-55419 · GHSA-m2pc-3q4q-w6jr
- Affected
- PyPI reachy-mini < 1.8.2
- Fixed in
- 1.8.2· Vendor fix available
- Issue
- The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full Root Access This issue is part of a full compromise chain allowing an unauthenticated user to gain root access on the Reachy’s operating system: 1. Unrestricted File Upload in Media Sounds Upload API \<= current finding 2. Bluetooth Authentication Bypass 3. Bluetooth Directory Traversal Description The root cause of the issue is at the handler located in “src/daemon/app/routers/media.py” file at the “upload\sound” method: This endpoint lacks multiple defence mechanisms: 1. No authentication mechanism. 2. No file extension validation. 3. No file content/size validation. Additionally, the daemon is bound to the 0.0.0.0 network interfaces (a.k.a. all network interfaces) by default along with…
Recommended action: Upgrade to 1.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.