Typebot CVE-2026-48768

Requires the target Typebot instance to have at least one published bot containing a file-input block (v3) whose generate-upload-url endpoint is reachable; no authentication, no user interaction, and no admin access are required, consistent with PR:N/UI:N. Exploitation is limited to keys reachable under the public/ prefix of the configured S3 or MinIO bucket - '../' traversal is blocked by S3/MinIO canonicalization, so the attacker can only pivot via forward-slash injection within the public namespace. XSS severity further depends on whether the storage bucket is served from the same origin as the Typebot application; cross-origin storage limits impact to content hosting and phishing rather than same-origin script execution.

Signals are largely aligned toward real priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives a pre-auth, low-complexity, no-interaction network attack, S:C captures the cross-tenant pivot, and I:H reflects the ability to write arbitrary files into another tenant's content path; C:L and A:N correctly reflect that this is a write/integrity primitive, not data exfiltration. No EPSS, KEV, or SSVC data was provided, and no public exploit identified at time of analysis, so exploitation likelihood must be inferred from accessibility - any internet-reachable Typebot instance publishing a bot with a file-input block is exposed, which is a broad surface for SaaS multi-tenant deployments. One caveat: real impact depends on whether the storage origin is served on the same web origin as the bot UI; if assets are served from a separate sandboxed domain, XSS impact drops to content-hosting/phishing rather than session theft against typebot.io users - verify per deployment.

An attacker browses any internet-reachable Typebot instance, finds or generates a published bot URL that includes a file-input block, and calls the public generate-upload-url endpoint with a crafted fileName like 'public/<victim-workspace>/results/<victim-bot>/poc.html'. The server returns a presigned PUT URL targeting that key; the attacker PUTs an HTML or SVG payload (Content-Type is not bound by the signature) and links victims to the now-attacker-controlled URL under the victim tenant's path, triggering stored XSS or hosted phishing on the storage origin.