CVE-2026-127084: Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads
Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated Teable account with permission to upload attachments. Exploitation also requires convincing a victim to open the attacker-controlled same-origin attachment URL.
What conditions make an uploaded attachment dangerous?
SVG or HTML attachments are dangerous when uploaded with an attacker-chosen content type and then served inline from /api/attachments/read. The response has an empty Content-Security-Policy, allowing script to execute in the victim's authenticated session.
What can successful exploitation do?
Script running in the victim's session can perform Teable API actions as that victim. The provided information indicates impacts to confidentiality and integrity, but not availability.
How can I determine whether my deployment is affected?
Deployments running Teable versions before 2026-10-12T12-45-53Z.3331 are affected. An affected deployment permits authenticated users to upload SVG or HTML attachments with attacker-controlled content types that are served inline through /api/attachments/read.