CVE-2026-48763

TypeBot prior to v3.17.0 exposes a deprecated public upload endpoint GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url that returns a presigned S3 PUT URL for an attacker-controlled filePath. An unauthenticated attacker who knows a valid public typebotId and blockId can obtain ...

CVE-2026-48768

TypeBot (versions ≤ 3.16.1) exposes an unauthenticated generate-upload-url API (/api/blocks/file-input/v3/generate-upload-url) that uses unsanitized fileName to derive public S3 keys and issues presigned PUT URLs that do not bind Content-Type. This allows anonymous users of a published bot with a...