Typebot.io CVE-2026-48763

The deprecated endpoint GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url must be present and reachable - it was removed in 3.17.0, so only pre-3.17.0 deployments are vulnerable. S3 storage must be configured (S3_ENDPOINT, S3_ACCESS_KEY, and S3_SECRET_KEY must all be set); the handler explicitly returns an INTERNAL_SERVER_ERROR if any are missing, making the endpoint non-exploitable without S3. The attacker must supply a valid typebotId for any public typebot and a valid blockId corresponding to a file input block within that typebot - these are typically visible in embed HTML, share URLs, or can be enumerated from public chatbot API responses. No authentication is required (CVSS PR:N confirmed). Exploitation is limited to deployments with S3 storage active and running a version prior to 3.17.0; the filePath parameter is passed entirely unvalidated to the presigned URL generator, imposing no restriction on target key path.

The CVSS 8.2 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) accurately reflects the attack profile: network-accessible, low complexity, requiring no authentication or user interaction. The I:H rating corresponds to unrestricted write access to arbitrary S3 object paths including private/ namespaces and cross-tenant public/ paths. A:L reflects partial availability impact from potential file overwriting. C:N is consistent with the endpoint issuing only presigned PUT URLs, not GET - preventing direct data exfiltration via this vector alone. Real-world risk is highest for multi-tenant or SaaS Typebot deployments where tenant isolation in S3 is a security boundary. Self-hosted single-tenant deployments face a lower blast radius but are still vulnerable to arbitrary bucket writes. No EPSS data was provided in the input and the CVE is not in CISA KEV, so widespread in-the-wild exploitation is not confirmed. However, the low attack complexity and zero authentication requirement mean the theoretical exploitation bar is extremely low for any attacker who can identify a public Typebot instance.

An attacker visits any publicly shared Typebot chatbot and extracts the typebotId and blockId values from the embed code or network traffic - both are exposed in standard chatbot share links. The attacker then sends a GET request to /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url?filePath=private/other-tenant/sensitive-config.json, receives a valid presigned S3 PUT URL scoped to that exact key, and issues a PUT request with arbitrary content, overwriting a private object in the shared S3 bucket. No public exploit code has been confirmed at time of analysis, but the attack requires only curl or any HTTP client.