CVE-2026-73409

Received Received - Intake

Remote File Readability Oracle in Budibase Cloud

Publication date: 2026-08-12

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error, exposing a filesystem existence and readability oracle on the shared server. This issue is fixed in version 3.40.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-14

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73409

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	3.40.1
budibase	budibase	to 3.40.1 (exc)
budibase	server	to 3.40.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-203	The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

CVE-2026-73409 is a vulnerability in Budibase's server component affecting versions prior to 3.40.0. It involves an arbitrary-path existence/read oracle in the MongoDB datasource verification process. When creating a MongoDB datasource, Budibase passes tlsCertificateKeyFile and tlsCAFile fields directly to the MongoDB driver as server-side file paths without validation. This allows a builder to specify arbitrary absolute file paths on the underlying multi-tenant server.

Detection Guidance

To detect this vulnerability, check if your Budibase server version is prior to 3.40.1. Inspect MongoDB datasource configurations for tlsCertificateKeyFile and tlsCAFile fields containing absolute server paths. Test by attempting to verify a datasource with arbitrary file paths and observe error messages for filesystem existence leaks.

Impact Analysis

This vulnerability can expose server configuration files, secret files, and other tenants' paths. It allows content exfiltration via mutual-TLS by distinguishing readable existing files from missing files through error messages. Attackers can determine file existence and read file contents on the shared server.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized filesystem access and potential data exfiltration. It allows attackers to read sensitive server files, including configuration and secret files, which may contain personal or protected health information. The exposure of file existence and contents violates data protection principles under GDPR (e.g., integrity and confidentiality) and HIPAA (e.g., safeguards for protected health information).

Mitigation Strategies

Upgrade Budibase to version 3.40.1 or later. Ensure MongoDB datasource configurations do not include absolute file paths for TLS certificates. For cloud deployments, verify that backend validation rejects such paths. Review and restrict file access permissions on self-hosted instances.

Hi! I’m here to help you understand CVE-2026-73409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70