CVE-2026-127084

HIGH 7.3

Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions.

CWE	CWE-79
Vendor	teableio
Product	teable
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for teableio teable

Be the first to know when new high vulnerabilities affecting teableio teable are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

teableio / teable

0 < 2026-10-12T12-45-53Z.3331

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/teableio/teable/security/advisories/GHSA-2fm5-fcfx-hq5f github.com: https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa304 github.com: https://github.com/teableio/teable/releases/tag/release.2026-10-12T12-45-53Z.3331 github.com: https://github.com/teableio/teable/blob/5ef2238883cad7c3980084de9a9031135fb9734f/apps/nestjs-backend/src/features/attachments/attachments.controller.ts#L52-L71 vulncheck.com: https://www.vulncheck.com/advisories/teable-before-2026-10-12t12-45-53z-3331-stored-xss-via-attachment-uploads

Credits

Sandipkumar sah bugbunny.ai 0xtalon Luis Baronceli