Threats affecting pkg:github/AppFlowy-Cloud

AppFlowy Cloud versions up to 0.9.64 contain a stored cross-site scripting (XSS) vulnerability. Authenticated workspace members can upload blobs with unvalidated Content-Type headers, which are served inline without Content-Disposition headers or authentication. This allows an attacker to upload HTML or SVG content that is rendered as an active same-origin document via an unauthenticated endpoint, cached for one year, enabling persistent script execution for visitors accessing the URL.