CVE-2026-48763

creationtimestamp| type| source ---|---|--- 2026-08-11 22:01:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mstmiovjq32a...

CVE-2026-48763 TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...