The vulnerability in heymrun's heym (versions before 0.0.21) involves improper limitation of a pathname to a restricted directory in the upload_file() handler. Authenticated users can exploit the lack of validation on the filename parameter by including path traversal sequences (e.g., '../') to bypass directory restrictions. This enables attackers to write, read, or delete files outside the intended storage directory, potentially compromising system integrity or confidentiality. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, no user interaction, and high impact on integrity and availability with low impact on confidentiality.

Successful exploitation allows authenticated users to manipulate files outside the designated upload directory, potentially leading to unauthorized file modification, disclosure, or deletion. This can compromise system integrity and availability. There is no indication of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality to trusted users only and monitor for suspicious activity related to file uploads. Avoid exposing the vulnerable endpoint to untrusted networks.