{"id":"CVE-2026-127203","kind":"vulnerability","aliases":["CVE-2026-127203"],"related":[],"title":"AppFlowy Cloud: uploaded HTML files run scripts in visitors' browsers","description":"AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload blobs with unvalidated Content-Type values that are later served inline without a Content-Disposition header or authentication on the retrieval route. Attackers can upload a text/html or image/svg+xml blob via put_blob_handler, which is then rendered as an active same-origin document through the unauthenticated get_blob_handler endpoint and cached immutably for one year, enabling persistent script execution against any visitor who accesses the URL.","summary":"AppFlowy Cloud through 0.9.64 serves uploaded files with an attacker-chosen content type and no download header, so an uploaded HTML or SVG file runs as a page on the AppFlowy domain. An attacker who is a workspace member can make any visitor who opens the link run scripts in their session, and the response is cached for a year.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AppFlowy Cloud","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["appflowy-cloud","other","self-hosted"],"not_affected_if":["newer-version","no-file-uploads"],"how_to_check":"- Check the AppFlowy Cloud version with the deployed image tag or release (`0.9.64` or earlier is affected per the sources)\n- Look for the `put_blob_handler` and `get_blob_handler` routes in the deployed build's source if you build from source","fix":null,"status":"open","published_at":"2026-11-12T17:17:43+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","triaged_at":"2026-11-12T17:40:06+00:00","updated_at":"2026-11-12T17:40:06+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T17:40:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AppFlowy Cloud: uploaded HTML files run scripts in visitors' browsers","impact":"medium","summary":"AppFlowy Cloud through 0.9.64 serves uploaded files with an attacker-chosen content type and no download header, so an uploaded HTML or SVG file runs as a page on the AppFlowy domain. An attacker who is a workspace member can make any visitor who opens the link run scripts in their session, and the response is cached for a year.","audience":"businesses","category":"other","nicknames":[],"who_cares":["appflowy-cloud","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in visitor browsers on the AppFlowy origin","analyst_note":"Confirm the fixed version and whether the get_blob_handler route is public, using the NVD page and the VulnCheck advisory.","how_to_check":"- Check the AppFlowy Cloud version with the deployed image tag or release (`0.9.64` or earlier is affected per the sources)\n- Look for the `put_blob_handler` and `get_blob_handler` routes in the deployed build's source if you build from source\n- unknown","plain_action":"","product_name":"AppFlowy Cloud","needs_analyst":true,"not_affected_if":["newer-version","no-file-uploads"],"who_is_affected":"Teams that self-host AppFlowy Cloud through 0.9.64 and let workspace members upload files. Exposure depends on whether the blob retrieval route is reachable by visitors outside the workspace; the sources do not say whether a patched release exists.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000778,"input_tokens":4667,"output_tokens":623,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127203':13A,16A '-2026':12A,15A '0.9.64':29B,90C 'access':175C 'activ':149C 'allow':100C 'appflowi':1A,20B,26B,57B,87C 'appflowy':17A 'appflowy-cloud':19B 'attack':36B,60B,130C 'attacker-chosen':35B 'authent':101C,125C 'blob':106C,138C,141C,158C 'browser':10A 'cach':83B,162C 'chosen':37B 'cloud':2A,18A,21B,27B,88C 'contain':91C 'content':38B,110C,121C 'content-disposit':120C 'content-typ':109C 'cross':95C 'cross-sit':94C 'cve':11A,14A 'disposit':122C 'document':153C 'domain':58B 'download':42B 'enabl':167C 'endpoint':160C 'execut':170C 'file':5A,32B,50B 'get':157C 'handler':142C,159C 'header':43B,123C 'host':25B 'html':4A,47B 'image/svg':136C 'immut':163C 'inlin':117C 'later':115C 'link':73B 'make':67B 'member':65B,103C 'one':165C 'open':71B 'origin':152C 'page':54B 'persist':168C 'put':140C 'render':146C 'respons':81B 'retriev':128C 'rout':129C 'run':6A,51B,74B 'same-origin':150C 'script':7A,75B,97C,169C 'self':24B 'self-host':23B 'serv':30B,116C 'session':78B 'site':96C 'store':93C 'svg':49B 'text/html':134C 'type':39B,111C 'unauthent':156C 'unvalid':108C 'upload':3A,31B,46B,105C,132C 'url':177C 'valu':112C 'via':139C 'visitor':9A,69B,173C 'vulner':98C 'without':118C 'workspac':64B,102C 'xml':137C 'year':86B,166C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host AppFlowy Cloud through 0.9.64 and let workspace members upload files. Exposure depends on whether the blob retrieval route is reachable by visitors outside the workspace; the sources do not say whether a patched release exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["appflowycloud","cloud"],"ptokens":["appflowy","cloud"],"labels":["appflowycloud","medium","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-127203':13A,16A '-2026':12A,15A 'appflowi':1A 'appflowy':17A 'browser':10A 'cloud':2A,18A 'cve':11A,14A 'file':5A 'html':4A 'run':6A 'script':7A 'upload':3A 'visitor':9A","search_b":"'0.9.64':29B 'appflowi':20B,26B,57B 'appflowy-cloud':19B 'attack':36B,60B 'attacker-chosen':35B 'cach':83B 'chosen':37B 'cloud':21B,27B 'content':38B 'domain':58B 'download':42B 'file':32B,50B 'header':43B 'host':25B 'html':47B 'link':73B 'make':67B 'member':65B 'open':71B 'page':54B 'respons':81B 'run':51B,74B 'script':75B 'self':24B 'self-host':23B 'serv':30B 'session':78B 'svg':49B 'type':39B 'upload':31B,46B 'visitor':69B 'workspac':64B 'year':86B","search_c":"'0.9.64':90C 'access':175C 'activ':149C 'allow':100C 'appflowi':87C 'attack':130C 'authent':101C,125C 'blob':106C,138C,141C,158C 'cach':162C 'cloud':88C 'contain':91C 'content':110C,121C 'content-disposit':120C 'content-typ':109C 'cross':95C 'cross-sit':94C 'disposit':122C 'document':153C 'enabl':167C 'endpoint':160C 'execut':170C 'get':157C 'handler':142C,159C 'header':123C 'image/svg':136C 'immut':163C 'inlin':117C 'later':115C 'member':103C 'one':165C 'origin':152C 'persist':168C 'put':140C 'render':146C 'retriev':128C 'rout':129C 'same-origin':150C 'script':97C,169C 'serv':116C 'site':96C 'store':93C 'text/html':134C 'type':111C 'unauthent':156C 'unvalid':108C 'upload':105C,132C 'url':177C 'valu':112C 'via':139C 'visitor':173C 'vulner':98C 'without':118C 'workspac':102C 'xml':137C 'year':166C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T17:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127203","severity":null,"published_at":"2026-11-12T17:17:43+00:00","modified_at":"2026-11-12T17:17:43+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","fetched_at":"2026-11-12T17:39:39+00:00","note":null}],"documents":[{"id":136865,"url":"https://www.vulncheck.com/advisories/appflowy-cloud-stored-xss-via-blob-upload-content-type","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}