Skip to main content

Budibase CVE-2026-73409

| EUVDEUVD-2026-57509 MEDIUM
Observable Discrepancy (CWE-203)
2026-08-12 GitHub_M GHSA-ppr4-5f46-j9c6
Information Disclosure Oracle Budibase
5.1
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
2.7 LOW

Builder-level authentication required (PR:H) over network; impact is filesystem existence oracle only, no content exposure (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 12, 2026 - 22:03 EUVD
Source Code Evidence Fetched
Aug 12, 2026 - 20:52 vuln.today
Analysis Generated
Aug 12, 2026 - 20:52 vuln.today

DescriptionCVE.org

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error, exposing a filesystem existence and readability oracle on the shared server. This issue is fixed in version 3.40.1.

AnalysisAI

Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an information-disclosure oracle exploitable by authenticated builders. The tlsCertificateKeyFile and tlsCAFile fields in the MongoDB datasource configuration were passed unsanitized to the MongoDB driver as server-side filesystem paths, enabling a builder to probe arbitrary absolute paths on the shared multi-tenant server via /api/datasources/verify by comparing distinct driver error messages. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as Budibase Cloud builder
Delivery
Configure MongoDB datasource with arbitrary absolute server path
Exploit
POST to /api/datasources/verify
Execution
MongoDB driver reads target filesystem path
Persist
Compare driver error messages by file state
Impact
Enumerate server filesystem for sensitive path intelligence
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid builder-level authenticated session within a Budibase Cloud tenant, as confirmed by the CVSS 4.0 PR:H metric; standard app user or viewer roles are insufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately reflects the constrained impact: confidentiality impact is low because the oracle reveals only file existence and readability, not file contents, and exploitation requires builder-level authentication (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A malicious actor with builder-level access to a Budibase Cloud tenant submits a POST request to `/api/datasources/verify` with a MongoDB datasource configuration where `tlsCertificateKeyFile` is set to `/etc/shadow`. The MongoDB driver attempts a real filesystem read and returns `"error:0480006C:PEM routines::no start line"` (confirming the file exists and was read) versus a file-not-found error if the path is absent, allowing the attacker to systematically enumerate sensitive system files on the shared multi-tenant server. …
Remediation Upgrade to Budibase version 3.40.1, which resolves the issue by gating TLS file-path passthrough on the `SELF_HOSTED` environment variable - cloud deployments receive an empty MongoClient options object, eliminating filesystem access entirely. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Budibase

View all
CVE-2026-27702 CRITICAL POC
9.9 Feb 25

Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
CVE-2026-31816 CRITICAL POC
9.1 Mar 09

Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
CVE-2026-25040 HIGH POC
8.8 Jan 29

Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
CVE-2026-73406 HIGH POC
7.5 Aug 12

Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email

CVE-2026-31818 CRITICAL
9.9 Apr 03

Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
CVE-2026-73308 MEDIUM POC
5.7 Aug 12

OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
CVE-2022-3225 MEDIUM POC
5.7 Sep 16

Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
CVE-2026-30240 CRITICAL
9.6 Mar 09

Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
CVE-2026-73300 CRITICAL POC
9.6 Aug 12

SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
CVE-2026-73306 MEDIUM POC
5.3 Aug 12

Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
CVE-2026-41428 CRITICAL
9.1 Apr 24

Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
CVE-2026-35216 CRITICAL
9.0 Apr 03

Remote code execution in Budibase versions prior to 3.33.4 allows unauthenticated attackers to execute arbitrary Bash co

Same weakness CWE-203 – Observable Discrepancy

View all
CVE-2017-5753 MEDIUM POC
5.6
CVE-2017-13099 HIGH POC
7.5
CVE-2017-1000385 MEDIUM POC
5.9
CVE-2017-6168 HIGH POC
7.4
CVE-2017-13098 HIGH POC
7.5
CVE-2017-17427 MEDIUM POC
5.9
CVE-2018-3639 MEDIUM POC
5.5
CVE-2019-25337 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-73409 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy