The exposed /api/upload endpoint in HeyForm accepts file uploads without any authentication, session check, or form context verification, allowing any internet user to upload arbitrary files—including PDFs, DOCs, spreadsheets, and multimedia—and receive a publicly accessible URL. The lack of file‑type validation (CWE‑434) combined with missing authentication (CWE‑306) means the endpoint can be abused to host malicious content, facilitating phishing campaigns or malware delivery. Because the uploads are publicly reachable and the endpoint accepts files up to 10 MB, this vulnerability can be used to store large payloads or to flood the service with unwanted data.

HeyForm, the open‑source form builder, is affected by this issue in all releases prior to 3.0.0‑rc.9. The vendor product is simply "HeyForm". No specific version ranges are listed beyond the cutoff, so any deployment using an older version of HeyForm remains vulnerable until upgraded.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score of 0.00298 (~<1%) suggests a very low current exploitation probability, but the lack of authentication and public nature of the endpoint make exploitation straightforward for anyone with Internet access. As this vulnerability is not listed in the CISA KEV catalog, it is not currently part of a known active exploit set, but the high CVSS and the ability to host arbitrary files suggest that future abuse is likely. Attackers would only need to craft an HTTP POST to /api/upload with a file payload; no special privileges are required, and the resulting public URL can be shared externally, enabling malicious content distribution.