Description

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the upload_sound method in src/reachy_mini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS allow_origins=["*"], allowing an unauthenticated network attacker to upload arbitrary file types that are written to /tmp/reachy_mini_sounds/<original_filename>. Malicious files can compromise stored-data integrity and can serve as a foothold when combined with other vulnerabilities. This issue is fixed in version 1.8.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-25T18:17:55.793Z",
  "pubdate": "2026-08-25T18:17:55.793Z",
  "executiveSummary": "Reachy Mini versions prior to 1.8.2 contain an unauthenticated arbitrary file upload vulnerability within the daemon's media management interface.\nThe vulnerability originates from the /api/media/sounds/upload endpoint, which lacks authentication, authorization, and input validation controls.\nBy default, the daemon binds to all network interfaces (0.0.0.0) and employs overly permissive Cross-Origin Resource Sharing (CORS) policies, enabling remote attackers to upload arbitrary files to the host filesystem.\nThe primary impact involves unauthorized write access to the /tmp/reachy_mini_sounds/ directory, leading to potential system compromise, data integrity loss, and the introduction of malicious payloads.\nAttackers can leverage this flaw to establish a persistent foothold on the robotic platform, potentially leading to further privilege escalation or arbitrary code execution depending on subsequent environment interactions.\nSuccessful exploitation requires no prior authentication and can be executed over any reachable network path.",
  "technicalDetails": "The vulnerability resides in the src/reachy_mini/daemon/app/routers/media.py file within the upload_sound method of the Reachy Mini daemon.\nThe root cause is a complete lack of security controls on the file upload endpoint. Specifically, the method fails to implement authentication, file extension verification, content type inspection, or file size constraints.\nThe daemon is configured to listen on 0.0.0.0, exposing the service to external network traffic, and defines CORS policies with allow_origins=['*'], which facilitates cross-site exploitation vectors.\nThe attack flow begins with an unauthenticated attacker sending a multipart/form-data POST request to the /api/media/sounds/upload endpoint. Because the server does not perform validation, it blindly writes the uploaded content to the /tmp/reachy_mini_sounds/ directory, using the attacker-supplied filename.\nBecause the server preserves the original filename, an attacker can perform directory traversal or overwrite critical files if the system lacks sufficient filesystem permission restrictions. Furthermore, the ability to upload arbitrary file types allows for the placement of malicious scripts or executable binaries within the /tmp directory.\nWhile the /tmp directory typically has restricted execution contexts, this vulnerability provides a critical foothold. When combined with other vulnerabilities in the Reachy Mini ecosystem, an attacker can use this uploaded payload to gain further execution privileges or manipulate the robot's behavior through filesystem interference.\nThe lack of content validation implies that the daemon does not scan for malicious signatures or verify that the file conforms to expected audio formats, allowing for the storage of arbitrary data on the host machine.\nAll Reachy Mini installations version 1.8.1 and earlier are confirmed to be susceptible to this configuration."
}