TypeBot’s generate-upload-url endpoint allows unauthenticated users to upload files whose names are directly used to form S3 object keys. Because the fileName is not sanitized and the presigned PUT URL does not restrict Content-Type, attackers can deposit maliciously crafted HTML, SVG, or JavaScript to arbitrary public paths. The uploaded content can then be served from the storage origin, making stored cross‑site scripting and hosting of arbitrary web resources possible on a published bot.

All TypeBot installations using version 3.16.1 or earlier are vulnerable. This includes publicly deployed bots that expose the file‑input endpoint. Users of the 3.17.0 release and later are not affected.

The CVSS score of 9.3 signals a high‑severity flaw, but the EPSS score indicates that exploitation is currently unlikely (<1%). The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only unauthenticated access to the exposed endpoint, so the attack vector is straightforward for any external user. Because the endpoint is public, the window for unauthorized content injection is wide and can affect other tenants via forward‑slash path injection, even though directory traversal is mitigated by the storage service’s canonicalization.