CVE-2026-55419: reachy_mini Allows Unrestricted Upload of File with Dangerous Type

August 25, 2026

The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks.

References

github.com/advisories/GHSA-m2pc-3q4q-w6jr
github.com/pollen-robotics/reachy_mini/commit/984c7723b3ec5da63f4e0a2bcf9f120ceb563e04
github.com/pollen-robotics/reachy_mini/security/advisories/GHSA-m2pc-3q4q-w6jr
nvd.nist.gov/vuln/detail/CVE-2026-55419

Code Behaviors & Features

Detect and mitigate CVE-2026-55419 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →