CVE-2026-62865 in Typebot
Summary
by MITRE • 08/26/2026
Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the supplied value as a filesystem path whenever it does not start with the application's own base URL, instead of requiring an http or https URL. The Nodemailer transport is created without disableFileAccess or disableUrlAccess, both of which default to false, so an attachment specified as an absolute server path is read from the local filesystem and delivered. Because both the attachment value and the recipient list are attacker-controllable typebot variables, any registered user can publish a bot whose Send Email block attaches an absolute path such as /etc/passwd or /proc/self/environ and mails it to an address they control. This enables reading any file the server process can access, including process environment secrets such as the credential encryption key and database connection string, without administrative privileges or victim interaction. Open signup is enabled by default and the system SMTP credential is already configured, so no non-default configuration is required. This issue is fixed in version 3.18.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in self-hosted instances of Typebot prior to version 3.18.0 represents a critical server-side file read flaw within the Send Email integration block. As an open-source chatbot builder, Typebot allows users to construct automated workflows that include sending emails via Nodemailer. The core technical deficiency lies in how the application handles attachment configurations derived from user-supplied variables. Specifically, the parseAttachments helper function is designed to process file attachments for email messages but contains a logic error regarding URL validation. When constructing an attachment object, the code checks if the provided value begins with the application's own base URL. If it does not, rather than enforcing that the input must be a valid HTTP or HTTPS remote resource, the system defaults to treating the string as a local filesystem path. This design choice fundamentally breaks the isolation between user-controlled data and server-side file operations, allowing arbitrary files on the host machine to be included in outgoing emails.
The operational impact of this flaw is severe because it enables unauthenticated or low-privilege users to exfiltrate sensitive information from the server environment without requiring administrative access or interaction with a victim other than their own bot configuration. Since both the attachment source and the recipient list are controllable through typebot variables, an attacker can create a chatbot that automatically reads arbitrary files such as /etc/passwd, application logs, or critical configuration files like database connection strings and credential encryption keys. The Nodemailer transport is instantiated without setting disableFileAccess to true, which means it permits reading from the local disk by default. Consequently, any registered user can publish a bot that attaches sensitive server-side content and sends it directly to an email address under their control. This bypasses traditional access controls because the action is performed programmatically within the context of the application process, granting the attacker read privileges equivalent to those of the Typebot service account.
This vulnerability aligns with CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor, and specifically relates to CWE-78, Improper Neutralization of Special Elements used in an OS Command, although here it manifests as improper input validation leading to local file inclusion rather than command injection. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to T1005, Data from Local System, where adversaries retrieve data directly from the compromised system without remote execution tools. The risk is further exacerbated by default configuration settings in Typebot; open signup is enabled by default, allowing anyone on the internet to create an account and exploit the flaw immediately after deployment. Furthermore, since SMTP credentials are often pre-configured or easily set up during initial installation, the attack vector requires no additional privilege escalation steps beyond basic user registration.
To mitigate this vulnerability, organizations running self-hosted Typebot instances must upgrade to version 3.18.0 or later, where the parseAttachments logic has been corrected to strictly validate that attachment sources are remote URLs and not local paths. For environments unable to patch immediately due to dependency constraints, a temporary mitigation involves configuring Nodemailer with disableFileAccess set to true in any custom integration code if applicable, though this may require modifying core application files which is generally discouraged for maintenance reasons. Additionally, administrators should review access controls by disabling open signup until the patch is applied and restricting network egress from the server to prevent data exfiltration via email protocols. Regular auditing of user-created bots and monitoring outbound SMTP traffic can also help detect exploitation attempts in real-time while longer-term architectural improvements are implemented to enforce strict input validation on all file system interactions within the application logic.