CVE-2026-127203: AppFlowy Cloud 0.9.64 Stored XSS via Blob Upload Content-Type
AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload blobs with unvalidated Content-Type values that are later served inline without a Content-Disposition header or authentication on the retrieval route. Attackers can upload a text/html or image/svg+xml blob via putblobhandler, which is then rendered as an active same-origin document through the unauthenticated getblobhandler endpoint and cached immutably for one year, enabling persistent script execution against any visitor who accesses the URL.
Event History
Frequently Asked Questions
Who can exploit this issue and who is at risk?
An authenticated workspace member can upload a blob with an attacker-controlled Content-Type. Any person who accesses the resulting blob URL can be exposed to persistent same-origin script execution, because retrieval does not require authentication.
Does exploitation require user interaction?
Yes. The attacker must first be an authenticated workspace member and upload a malicious HTML or SVG blob. A victim must then access the blob URL for the active content to execute.
Why can the malicious content remain available after it is uploaded?
Blob responses are cached immutably for one year. This can allow a malicious uploaded blob to remain served from cache for that period after the original upload.