Typebot CVE-2026-48768
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Unauthenticated network endpoint (AV:N/AC:L/PR:N/UI:N); cross-tenant write into a separate security authority gives S:C and I:H; minor C:L from key enumeration; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any anonymous visitor to a published bot with a file input can upload attacker-controlled HTML, SVG, or JS to attacker-chosen subpaths, including other tenants’ publicly served result paths, enabling arbitrary content hosting and potential stored XSS on the storage origin. ../ traversal is blocked by S3/MinIO canonicalization (signature mismatch), but forward-slash path injection is exploitable. This issue has been fixed in version 3.17.0.
AnalysisAI
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visitors of any published bot containing a file-input block to write attacker-controlled HTML, SVG, or JavaScript into arbitrary subpaths of the shared public S3 bucket. The flaw stems from an unauthenticated presigned-URL endpoint that trusts a raw fileName parameter and does not bind Content-Type, enabling stored XSS on the storage origin and content hosting under other tenants' result paths. No public exploit identified at time of analysis, but the CVSS 9.3 (scope-changed) reflects significant cross-tenant impact.
Technical ContextAI
Typebot.io is an open-source chatbot/form builder (CPE cpe:2.3:a:baptistearno:typebot.io) that lets creators publish bots with file-upload blocks backed by S3-compatible object storage (AWS S3 or self-hosted MinIO). The vulnerable endpoint POST /api/blocks/file-input/v3/generate-upload-url is intended to mint short-lived presigned PUT URLs scoped to the uploader's bot, but it concatenates the client-supplied fileName directly into the public/ S3 key prefix without sanitization, and the presigned signature does not pin Content-Type. This is a classic CWE-22 path traversal expressed through forward-slash injection rather than '../' - S3/MinIO canonicalize '../' segments and reject the resulting signature mismatch, but raw '/' characters are preserved in the canonical key, letting an attacker pivot the upload into any sibling key including other tenants' published result directories.
RemediationAI
Vendor-released patch: 3.17.0 - upgrade to https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0, which is the primary fix and resolves both the fileName sanitization and the missing Content-Type binding on presigned URLs. If immediate upgrade is not possible, compensating controls include disabling or removing file-input blocks from all published bots (loses file-collection functionality), placing the /api/blocks/file-input/v3/generate-upload-url endpoint behind authentication or a WAF rule that rejects fileName values containing '/' (may break legitimate uploads that include subfolders), and serving the S3/MinIO public bucket from a sandboxed origin distinct from the Typebot app origin with Content-Security-Policy and Content-Disposition: attachment forced on text/HTML/SVG types (mitigates stored XSS but not content hosting). Refer to advisory GHSA-fp7x-6pqh-vhvf for vendor guidance.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user ho
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today