CVE-2026-73409

UNKNOWN 0.0

Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error, exposing a filesystem existence and readability oracle on the shared server. This issue is fixed in version 3.40.1.

CWE	CWE-203
Vendor	budibase
Product	budibase
Published	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for budibase budibase

Be the first to know when new unknown vulnerabilities affecting budibase budibase are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Budibase / budibase

< 3.40.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Budibase/budibase/security/advisories/GHSA-ppr4-5f46-j9c6 github.com: https://github.com/Budibase/budibase/pull/19244 github.com: https://github.com/Budibase/budibase/commit/e58aa31e18272f6a1a8aeb525b7eef0b01b1dd43 github.com: https://github.com/Budibase/budibase/releases/tag/3.40.1