CVE-2026-127084
Received Received - Intake

Stored XSS in Teable via SVG/HTML Attachments

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127084
EUVD
EUVD-2026-125098

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
teableio teable to 2026-10-12T12-45-53Z.3331 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Teable before version 2026-10-12T12-45-53Z.3331. It allows authenticated users to upload SVG or HTML files with manipulated content types like image/svg+xml or text/html. The application does not enforce a MIME type allowlist, so attackers can declare arbitrary content types. When served via the /api/attachments/read endpoint, the file is rendered inline with an empty Content-Security-Policy, enabling script execution in the victim's authenticated session.

Detection Guidance

Check for uploaded SVG or HTML files with manipulated content types in your Teable instance. Inspect the /api/attachments/read endpoint for files served inline without proper Content-Security-Policy headers. Review file upload logs for non-standard MIME types like image/svg+xml or text/html.

Impact Analysis

An attacker can craft a malicious SVG or HTML file containing JavaScript that executes in your authenticated session. This could allow unauthorized API actions, such as reading or modifying your data, performing actions on your behalf, or hijacking your session. The attack requires victim interaction, such as opening a crafted URL, and is exploitable by any authenticated user or share-link viewer.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. It may result in data breaches, unauthorized data exposure, or manipulation, which could lead to non-compliance with these regulations. Organizations using affected Teable versions should apply the patch immediately to mitigate risks.

Mitigation Strategies

Upgrade Teable to version 2026-10-12T12-45-53Z.3331 or later. Enforce a strict content-type allowlist during file uploads to block scriptable MIME types. Remove or sanitize existing SVG/HTML attachments uploaded before the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...