---
id: "CVE-2026-127084"
page: "https://infrastack.ai/live/CVE-2026-127084"
kind: "vulnerability"
aliases: ["CVE-2026-127084"]
title: "Teable: stored XSS via uploaded SVG or HTML attachments"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "teable", "web-apps"]
not_affected_if: ["fixed-version", "no-attachment-uploads"]
published_at: "2026-11-13T10:18:04+00:00"
first_seen_at: "2026-11-13T10:47:29+00:00"
updated_at: "2026-11-13T10:50:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127084", "first_seen_at": "2026-11-13T10:47:29+00:00"}]
exploit_sources: []
---

# Teable: stored XSS via uploaded SVG or HTML attachments

Link for people: https://infrastack.ai/live/CVE-2026-127084 (this .md is for agents)

Teable lets logged-in users upload SVG or HTML attachments with an attacker-chosen content type, and the attachment URL is served inline with no Content-Security-Policy. An attacker can make a victim open that same-origin link so script runs with the victim's session and performs API actions as them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Teable version in the deployment, for example `teable` image tag or package version, and compare it to the fixed build.
- Look for uploads served from `/api/attachments/read` with an SVG or HTML content type.

## Fix

- Teable: move to a build at or after `2026-10-12T12-45-53Z.3331`

## Timeline

- 2026-11-13T10:47:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127084

## Documents

- [advisory] Vendor advisory: github.com https://github.com/teableio/teable/security/advisories/GHSA-2fm5-fcfx-hq5f
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/teable-before-2026-10-12t12-45-53z-3331-stored-xss-via-attachment-uploads
- [fix] Patch: github.com https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa304
- [fix] Release notes: github.com https://github.com/teableio/teable/releases/tag/release.2026-10-12T12-45-53Z.3331

## From the sources

Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_