CVE-2026-48763 in TypeBot
Summary
by MITRE • 08/12/2026
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url` that accepts an attacker-controlled `filePath` and returns a presigned S3 `PUT` URL for that exact key. Because the endpoint only checks that the referenced typebot is public and that the referenced block is a file input block, an unauthenticated attacker who knows a valid public `typebotId` and `blockId` can request presigned upload URLs for arbitrary objects in the shared bucket, including `private/...` and other tenants' `public/...` paths. Version 3.17.0 fixes this issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in TypeBot versions prior to 3.17.0 represents a critical access control flaw that enables unauthorized data exposure through improper validation of file upload paths. This weakness exists within the deprecated public upload endpoint located at GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url which accepts attacker-controlled filePath parameters and generates presigned S3 PUT URLs for arbitrary object keys. The vulnerability stems from insufficient authorization checks that only verify the existence of a public typebot and a file input block without validating whether the requested file path is within appropriate boundaries or belongs to the legitimate user's namespace.
The technical implementation flaw allows attackers to exploit the system through a simple request pattern that leverages knowledge of valid public typebot identifiers and block identifiers. When an attacker makes a request to this endpoint, the system generates a presigned URL for the exact file path provided in the filePath parameter without proper validation against tenant boundaries or access controls. This creates a path traversal scenario where attackers can target not only their own objects but also private files belonging to other tenants within the same shared S3 bucket, effectively bypassing the intended multi-tenant isolation mechanisms.
The operational impact of this vulnerability is severe and multifaceted, encompassing data leakage, tenant isolation breaches, and potential privilege escalation. An unauthenticated attacker who discovers a valid public typebotId and blockId can construct malicious requests to generate upload URLs for arbitrary S3 object keys including private/... paths and other tenants' public/... directories. This exposure could lead to unauthorized data modification, information disclosure, and cross-tenant data access that violates fundamental security principles of cloud service isolation. The vulnerability essentially transforms a legitimate file upload endpoint into a universal data write interface that bypasses normal access controls.
This issue maps directly to CWE-22 Path Traversal and CWE-285 Improper Authorization, with implications for the ATT&CK technique T1078 Valid Accounts and T1566 Phishing. The vulnerability demonstrates a classic lack of input validation combined with insufficient authorization enforcement. Organizations using TypeBot should immediately upgrade to version 3.17.0 or later to receive the proper fix that implements comprehensive path validation and tenant boundary enforcement. Additional mitigations include implementing strict access control policies for S3 bucket objects, enforcing namespace isolation between tenants, and conducting regular security assessments of API endpoints that handle file operations. The fix should ensure that all file upload paths are validated against user permissions and tenant boundaries before generating presigned URLs, preventing unauthorized access to resources outside the intended scope.