Version 3.17.0 and earlier allow an unauthenticated attacker to obtain a presigned S3 PUT URL for any key path by sending a request to the deprecated public upload endpoint with an attacker‑controlled filePath value. Because the endpoint only verifies that the typebot is public and that the block is a file‑input block, an attacker who knows a public typebot ID and a block ID can write to arbitrary objects in the shared S3 bucket, including private and other tenants’ paths. This flaw enables data injection, modification, or overwriting across multiple accounts, thereby potentially compromising confidentiality, integrity, and availability of stored data.

baptisteArno:typebot.io – any deployment running TypeBot versions prior to 3.17.0 contains the vulnerable endpoint. The specific affected functionality is the GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url handler, which returns presigned URLs for arbitrary S3 keys.

The CVSS score of 8.2 reflects the high impact of this vulnerability. Although the EPSS score is reported as < 1%—indicating a very low exploitation probability in the wild—this does not diminish the potential damage should the flaw be exploited. No KEV listing is present, but the vulnerability could be attractive to attackers looking to tamper with data in shared S3 buckets. Exploitation requires only knowledge of a public typebot and a block identifier; no authentication or privileged credentials are needed, making the attack vector effectively remote and unauthenticated.