CVE-2026-127084 · Package
NO FIX YET · SEE WHAT TO DO
Teable lets logged-in users upload SVG or HTML attachments with an attacker-chosen content type, and the attachment URL is served inline with no Content-Security-Policy. An attacker can make a victim open that same-origin link so script runs with the victim's session and performs API actions as them.
first public Oct 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or managed Teable instances that allow authenticated users to upload attachments. The attack needs a logged-in account and a victim who opens the crafted link; instances on a build at or after the fixed version are not affected.
Not affected if fixed-version, no-attachment-uploads
Who cares self-hosted, teable, web-apps
teable image tag or package version, and compare it to the fixed build./api/attachments/read with an SVG or HTML content type.2026-10-12T12-45-53Z.3331Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.