CVE-2026-102615 | HeyForm up to 3.0.0 File Upload /api/upload cross-domain policy

November 5, 2026 Yanac

A vulnerability marked as problematic has been reported in HeyForm up to 3.0.0. This affects an unknown function of the file /api/upload of the component File Upload. Performing a manipulation results in permissive cross-domain policy with untrusted domains.

This vulnerability is known as CVE-2026-102615. Remote exploitation of the attack is possible. No exploit is available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More