CVE-2026-55419: Unrestricted File Upload in Pollen Robotics Reachy Mini SDK

Vulnerability ID: CVE-2026-55419
CVSS Score: 5.3
Published: 2026-08-25

An unrestricted file upload vulnerability exists in the Pollen Robotics Reachy Mini robot daemon prior to version 1.8.2. Unauthenticated remote attackers can upload arbitrary files to the temporary sounds directory over the network, leading to disk pollution and staging for potential secondary local exploits.

TL;DR

Unauthenticated arbitrary file upload on the Reachy Mini daemon allows attackers to write files to /tmp/reachy_mini_sounds/ over the network.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-434
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 5.3 (Medium)
Exploit Status: PoC available
Remediation: Upgrade to v1.8.2

Affected Systems

Pollen Robotics Reachy Mini SDK (reachy_mini daemon)
reachy_mini: < 1.8.2 (Fixed in: 1.8.2)

Code Analysis

Commit: 984c772

Fix media upload by adding MaxBodySizeMiddleware, file extension white-listing, GStreamer audio structural validation, and atomic replace.

Mitigation Strategies

Restrict the daemon binding address from 0.0.0.0 to 127.0.0.1 if external network access is unnecessary.
Implement network firewalls to block port 8000 from public exposure.
Upgrade reachy_mini to version 1.8.2 or later.

Remediation Steps:

Identify the running reachy_mini daemon version using the CLI.
Update reachy_mini via the official package manager or git pull to version 1.8.2.
Restart the daemon to apply changes.
Verify that the /api/media/sounds/upload route returns 400 when submitting non-audio files.