CVE-2026-48763

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0

Description A deprecated public upload endpoint at GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url allows unauthenticated attackers to request presigned S3 PUT URLs for arbitrary objects in a shared bucket. The issue occurs because the endpoint only verifies if the referenced typebot is public and the block is a file input block, failing to properly validate the filePath variable. This allows attackers who possess a valid public typebotId and blockId to obtain upload URLs for sensitive paths, such as private/... or paths belonging to other tenants.

Recommendations Update to version 3.17.0.