Back cve.report

CVE-2026-48768 CVE Vulnerability Disclosures / 14h TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any anonymous visitor to a published bot with a file input can upload attacker-controlled HTML, SVG, or JS to attacker-chosen subpaths, including other tenants’ p

cve.report • June 18, 2026

Problem Types: CWE-22 | CWE-79 | CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CWE-79 CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-48768 Vulnerability in TypeBot Exposes Users to File Upload Attacks A critical vulnerability, CVE-2026-48768, was disclosed affecting TypeBot versions 3.16.1 and earlier. The flaw allows unauthenticated users to exploit the POST /api/blocks/file-input/v3/generate-upload-url endpoint, which improperly handles unsanitized fileName inputs. This enables anonymous visitors to upload malicious HTML, SVG, or JS files to arbitrary S3 object paths, potentially affecting multiple tenants. The vulnerability was published on June 17, 2026, and poses severe risks to any deployed bots using the affected versions. Immediate intervention is required to mitigate the risks associated with this flaw. Organizations using TypeBot are urged to assess their exposure and implement necessary security measures. 2 sources 79

Extracted Entities

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (2)

Vulnerabilities (1)