The supplied endpoint upload_file() in Heym accepts a filename parameter that is used directly to store an uploaded file. The code does not sanitize or validate the filename, allowing an attacker who can authenticate to the application to supply a payload such as ../../../etc/passwd. The unfiltered path components bypass the intended storage directory, enabling an attacker to write arbitrary files with arbitrary names to any location reachable by the web process. This can lead to the creation of malicious binaries, privilege escalation, or the disclosure of sensitive data.

The vulnerability affects the Heym application version earlier than 0.0.21. The affected vendor is Heym, as listed in the recognized CNA product. All installations running Heym before 0.0.21 are potentially exposed when they expose the upload_file() endpoint to authenticated clients.

The CVSS score of 7.2 indicates a high severity. No EPSS information is available, but the absence of a KEV listing suggests no known public exploitation yet. The path traversal flaw can be leveraged by any authenticated user, implying an internal user or compromised credentials could be used. The risk is significant especially in environments where file uploads are permitted by privileged users, as an attacker could then place code or sensitive files outside the intended directory.