HeyForm’s upload service accepts arbitrary files through the /api/upload endpoint before authentication. SVG files are stored as static assets and served with the MIME type image/svg+xml. An attacker can embed malicious scripts inside an SVG, causing browsers that load the file to execute the script in the context of the heyform domain, leading to stored cross‑site scripting. This permits an attacker to hijack sessions, deface pages, or perform other malicious actions on users who view the uploaded content.

Products affected are the open‑source heyform form builder from the heyform organization. Any deployment running a version earlier than 3.0.0‑rc.7 is vulnerable. Version 3.0.0‑rc.7 includes a patch that removes the unauthenticated upload capability for SVG files and validates file types.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is 0.00404, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication for the affected endpoint means an attacker with network access can upload a malicious SVG and any user who views the file will be impacted. The vulnerability relies on user interaction (viewing the uploaded SVG) rather than stealth exploitation, so the attack vector is relatively straightforward for a determined adversary. Given the moderate severity and the availability of a patch, the risk is high enough to warrant immediate remediation.