CVE-2026-127203

Description

AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload blobs with unvalidated Content-Type values that are later served inline without a Content-Disposition header or authentication on the retrieval route. Attackers can upload a text/html or image/svg+xml blob via put_blob_handler, which is then rendered as an active same-origin document through the unauthenticated get_blob_handler endpoint and cached immutably for one year, enabling persistent script execution against any visitor who accesses the URL.

References

https://www.vulncheck.com/advisories/appflowy-cloud-stored-xss-via-blob-upload-content-type

https://gist.github.com/mtholmquist/9b9683104fc3b5d78a488c06a6674e5c

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124540

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS