CVE-2026-73409 in Budibase
Summary
by MITRE • 08/12/2026
Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error, exposing a filesystem existence and readability oracle on the shared server. This issue is fixed in version 3.40.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists within Budibase's MongoDB integration functionality where the platform fails to properly validate user-provided file paths before passing them to the underlying MongoDB client library. The flaw resides in the packages/server/src/integrations/mongodb.ts file which directly accepts tlsCertificateKeyFile and tlsCAFile parameters from builder inputs without implementing proper sanitization or validation measures. When builders submit absolute server paths through the /api/datasources/verify endpoint, the system processes these inputs and passes them directly to the MongoClient configuration, creating a dangerous path traversal condition that can be exploited by malicious actors.
The technical implementation of this vulnerability allows for information disclosure through error-based reconnaissance techniques. Attackers can exploit the difference in error messages returned by the MongoDB driver when attempting to access files that exist versus those that do not exist on the server filesystem. This creates a filesystem existence oracle where an attacker can determine which files are readable and accessible on the shared server environment simply by observing the specific error responses from the database connection attempt. The vulnerability essentially provides a method for attackers to enumerate server files without requiring direct access to the system, as the MongoDB driver's error handling reveals information about file system state.
The operational impact of this vulnerability is significant for organizations using Budibase Cloud services, particularly those running on shared hosting environments where multiple tenants may be present. An attacker could leverage this oracle to discover sensitive files, configuration data, or other system artifacts that might contain credentials, keys, or other exploitable information. This type of information disclosure vulnerability can serve as a precursor to more serious attacks, potentially leading to privilege escalation, data exfiltration, or further system compromise. The vulnerability affects the confidentiality and integrity aspects of the system's security posture.
The fix implemented in version 3.40.1 addresses this issue by introducing proper input validation and sanitization measures for file path parameters before they are passed to the MongoDB client. This remediation aligns with security best practices for handling user-controlled inputs, particularly when dealing with file system operations. The solution likely involves implementing strict path validation that prevents absolute paths from being accepted, or at minimum validates that submitted paths do not traverse outside of designated safe directories. From a compliance perspective, this vulnerability would map to CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path) in the Common Weakness Enumeration catalog.
From an attack framework perspective, this vulnerability could be categorized under ATT&CK technique T1083 (File and Directory Discovery) as attackers would use it to enumerate accessible files on the system. The vulnerability also demonstrates characteristics of privilege escalation pathways since it allows for information gathering that can lead to more sophisticated attacks. Organizations should consider implementing network segmentation and access controls around critical systems, along with regular security assessments to identify similar path traversal vulnerabilities in their applications. The fix represents a necessary defensive measure against attackers who might attempt to leverage such information disclosure weaknesses to gain deeper insights into system configurations and file structures.
This vulnerability highlights the importance of proper input validation in server-side applications, particularly when dealing with database connection parameters that involve file system interactions. The issue demonstrates how seemingly simple parameter passing can create significant security risks when proper sanitization techniques are not applied. Regular security audits and code reviews should specifically target areas where user inputs are passed to system functions that interact with the file system or network resources. Organizations using open-source platforms like Budibase should maintain active monitoring of security advisories and promptly apply patches to mitigate known vulnerabilities that could be exploited in their environments.