CVE-2026-45225 describes a path traversal vulnerability in the Heym application prior to version 0.0.21. The issue exists in the upload_file() handler where the filename parameter is not properly validated, allowing authenticated users to bypass directory restrictions by including traversal sequences in the filename. This enables attackers to write, read, or delete files outside the designated storage directory, potentially compromising system integrity or confidentiality. The vulnerability has a CVSS 4.0 base score of 7.2, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and limited privileges needed.

Exploitation of this vulnerability allows an authenticated attacker to perform unauthorized file operations outside the intended directory, including writing arbitrary files, reading sensitive files, or deleting files. This can lead to data compromise, unauthorized modification, or disruption of service. The vulnerability does not require user interaction and has low complexity, increasing the risk of exploitation in environments where authentication is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload endpoint to trusted users only and monitor for suspicious file upload activity. Validate and sanitize all filename inputs to prevent path traversal sequences. Implement strict access controls on file system locations accessible by the application.