CVE-2026-127203
AppFlowy Cloud 0.9.64 Stored XSS via Blob Upload Content-Type
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload blobs with unvalidated Content-Type values that are later served inline without a Content-Disposition header or authentication on the retrieval route. Attackers can upload a text/html or image/svg+xml blob via put_blob_handler, which is then rendered as an active same-origin document through the unauthenticated get_blob_handler endpoint and cached immutably for one year, enabling persistent script execution against any visitor who accesses the URL.
| CWE | CWE-79 |
| Vendor | appflowy-io |
| Product | appflowy-cloud |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for appflowy-io appflowy-cloud
Be the first to know when new medium vulnerabilities affecting appflowy-io appflowy-cloud are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
AppFlowy-IO / AppFlowy-Cloud
0 ≤ 0.9.64
References
Credits
Michael Holmquist (@mtholmquist), Hasp Labs.