점검 대응높음KEV 미등록
CVE-2026-45225
heymrun heym 취약점
Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.
- 대응 우선순위
- 점검
- CVSS
- 7.2
- EPSS
- 0.36% 백분위 28.2% · 2026.08.02 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.05.13