EUVD-2026-56979Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
No authentication required and network-accessible with low complexity; I:H for unrestricted S3 key write; C:N because the endpoint issues PUT-only presigned URLs, not read access.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only checks that the referenced typebot is public and that the referenced block is a file input block, an unauthenticated attacker who knows a valid public typebotId and blockId can request presigned upload URLs for arbitrary objects in the shared bucket, including private/... and other tenants' public/... paths. Version 3.17.0 fixes this issue.
AnalysisAI
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URLs for arbitrary object keys - including other tenants' private paths - by supplying an attacker-controlled filePath parameter to a deprecated public upload endpoint. Exploitation requires only knowledge of a valid public typebotId and blockId, both of which are typically visible in chatbot embed codes or share links. No public exploit has been confirmed at time of analysis, and this CVE does not appear in CISA KEV, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates trivial remote unauthenticated exploitation against any Typebot deployment with S3 storage configured.
Technical ContextAI
Typebot.io is a Node.js open-source chatbot builder that uses Amazon S3 (or S3-compatible storage) for user file uploads. The vulnerable endpoint GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url was a deprecated handler implemented in packages/blocks/fileInput/src/api/deprecated/handleGetUploadUrl.ts. It called generatePresignedUrl() by passing the user-supplied filePath parameter directly, without any sanitization, prefix enforcement, or path scoping. Authorization only verified that the referenced typebot existed as a public entity and that the referenced block was a file input block - it never validated that the requested filePath was within the expected upload namespace for that typebot or session. This constitutes CWE-862 (Missing Authorization): the code authenticated the typebot context but failed to authorize the specific resource (the S3 key) being requested. CPE cpe:2.3:a:baptistearno:typebot.io:*:*:*:*:*:*:*:* covers all versions prior to 3.17.0. The endpoint was deleted entirely in the fix rather than patched, confirming the design was fundamentally insecure.
RemediationAI
Upgrade to Typebot version 3.17.0 or later, available at https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0. The fix (PR #2459, commit 7ae4c007) removes the vulnerable handleGetUploadUrl.ts handler entirely, eliminating the deprecated endpoint. If immediate upgrade is not feasible, operators should block HTTP requests matching the pattern GET /api/v1/typebots/*/blocks/*/storage/upload-url at a WAF or reverse proxy layer - note this will break file upload functionality for any chatbot flows that still depend on this deprecated endpoint, so usage should be audited before blocking. Additionally, restricting the S3 bucket policy to enforce path-based conditions (e.g., requiring the presigned URL key to start with a per-tenant prefix) would serve as a defense-in-depth control independent of the application fix, limiting cross-tenant write impact even if other path traversal issues exist. References: GHSA-m7f5-3wcm-x2c4 and https://github.com/baptisteArno/typebot.io/pull/2459.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user ho
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today