The Reachy Mini daemon is vulnerable to an Unrestricted File Upload in the Media Sounds Upload API
reachy-mini (reachy_mini daemon)
< 1.8.2
The Reachy Mini daemon exposes POST /api/media/sounds/upload without authentication or file validation. An unauthenticated attacker can upload arbitrary files (not only sound files) into /tmp/reachy_mini_sounds/<original_filename> on the daemon host. The handler in src/daemon/app/routers/media.py (upload_sound) strips path traversal from the filename but does not enforce an extension allow-list, content checks, or size limits. The daemon binds 0.0.0.0 by default and uses permissive CORS (allow_origins=["*"]), so the endpoint is reachable on every network interface the daemon is connected to. This issue is the first step in a documented compromise chain that also includes Bluetooth authentication bypass and Bluetooth directory traversal.
Step 1 - Start the daemon
.venv/bin/mjpython -m reachy_mini.daemon.app.main --sim --no-media
Step 2 - Confirm a normal wav upload works
curl -X POST http://<daemon_host>:<daemon_port>/api/media/sounds/upload \
-F "file=@/path/to/your/file.wav"
Step 3 - Upload an arbitrary shell script
curl -X POST http://<daemon_host>:<daemon_port>/api/media/sounds/upload \
-F "file=@/path/to/your/script.sh"
Step 4 - Verify the file was written
The script is stored under /tmp/reachy_mini_sounds/ with no authentication challenge and no type rejection, confirming unrestricted upload.
Upgrade to reachy-mini 1.8.2 or later. The fix allow-lists sound extensions, caps upload size, and validates content with GStreamer so only playable audio is accepted (https://github.com/pollen-robotics/reachy_mini/pull/1209). Until then, restrict network access to the daemon (firewall port 8000) and do not expose the media upload API on untrusted networks.
https://github.com/pollen-robotics/reachy_mini/security/advisories/GHSA-m2pc-3q4q-w6jr https://github.com/pollen-robotics/reachy_mini/commit/984c7723b3ec5da63f4e0a2bcf9f120ceb563e04 https://github.com/pollen-robotics/reachy_mini/releases/tag/v1.8.2 https://nvd.nist.gov/vuln/detail/CVE-2026-55419