Skip to content
Critical CVE-2026-48768 Vulnerability in TypeBot Exposes Users to File Upload Attacks

Critical CVE-2026-48768 Vulnerability in TypeBot Exposes Users to File Upload Attacks

First seen 18 Jun 2026, 15:27 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 19, 2026 at 14:07 UTC
  • •CVE-2026-48768 affects TypeBot versions 3.16.1 and earlier, allowing unauthenticated file uploads.
  • •Attackers can upload malicious files to arbitrary paths, impacting multiple tenants.
  • •The vulnerability has been rated critical, necessitating immediate remediation actions.

A critical vulnerability, CVE-2026-48768, was disclosed affecting TypeBot versions 3.16.1 and earlier. The flaw allows unauthenticated users to exploit the POST /api/blocks/file-input/v3/generate-upload-url endpoint, which improperly handles unsanitized fileName inputs. This enables anonymous visitors to upload malicious HTML, SVG, or JS files to arbitrary S3 object paths, potentially affecting multiple tenants. The vulnerability was published on June 17, 2026, and poses severe risks to any deployed bots using the affected versions. Immediate intervention is required to mitigate the risks associated with this flaw. Organizations using TypeBot are urged to assess their exposure and implement necessary security measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 124d ago How this analysis works

Timeline

2026-06-17
CVE-2026-48768 published
The critical vulnerability in TypeBot was officially disclosed, revealing severe security implications.
cve.report
2026-06-18
Vulnerability reported by multiple sources
CVE-2026-48768 was reported by cve.report and cve.akaoma.com, highlighting its critical nature.
cve.akaoma.com

More articles in this cluster (2)

Following this threat?

Track CVE-2026-48768 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3