EUVD-2026-125098

Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty...

CVE-2026-127084

The Teable application, in versions prior to 2026-10-12T12-45-53Z.3331 , is vulnerable to Stored Cross-Site Scripting (XSS) via attachment uploads. The root cause allows authenticated users to upload SVG or HTML attachments using an attacker-chosen content type. Attackers can then direct victims ...

CVE-2026-127084 Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads

Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty...