EUVD-2026-57509
GHSA-ppr4-5f46-j9c6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Builder-level authentication required (PR:H) over network; impact is filesystem existence oracle only, no content exposure (C:L), no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error, exposing a filesystem existence and readability oracle on the shared server. This issue is fixed in version 3.40.1.
AnalysisAI
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an information-disclosure oracle exploitable by authenticated builders. The tlsCertificateKeyFile and tlsCAFile fields in the MongoDB datasource configuration were passed unsanitized to the MongoDB driver as server-side filesystem paths, enabling a builder to probe arbitrary absolute paths on the shared multi-tenant server via /api/datasources/verify by comparing distinct driver error messages. No CISA KEV listing exists, but the GHSA advisory contains a fully working reproduction command; the vulnerability is specific to Budibase Cloud and does not affect self-hosted deployments.
Technical ContextAI
The affected component is packages/server/src/integrations/mongodb.ts in the Budibase server npm package (@budibase/server), identified by CPE cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*. Budibase's MongoDB integration passes the TLS configuration fields tlsCertificateKeyFile and tlsCAFile directly to the MongoClient constructor as filesystem paths, with no path allow-list, no confinement to a certificates directory, and no rejection of absolute or traversal paths. On Budibase Cloud (a multi-tenant SaaS), these paths resolve on the shared server filesystem rather than tenant-controlled infrastructure. CWE-203 (Observable Discrepancy) governs the root cause: the MongoDB driver emits meaningfully different errors depending on file state - a PEM parse error (error:0480006C:PEM routines::no start line) when the file is readable versus a file-not-found error when the path is absent - creating a side-channel that leaks filesystem state without directly exposing file contents. The fix in PR #19244 introduces buildMongoClientOptions(), which gates TLS file-path passthrough on the SELF_HOSTED environment variable, returning an empty options object for cloud deployments.
RemediationAI
Upgrade to Budibase version 3.40.1, which resolves the issue by gating TLS file-path passthrough on the SELF_HOSTED environment variable - cloud deployments receive an empty MongoClient options object, eliminating filesystem access entirely. The patched release is available at https://github.com/Budibase/budibase/releases/tag/3.40.1, with the fix commit at https://github.com/Budibase/budibase/commit/e58aa31e18272f6a1a8aeb525b7eef0b01b1dd43 and the implementing pull request at https://github.com/Budibase/budibase/pull/19244. For Budibase Cloud operators unable to upgrade immediately, the most effective compensating control is to audit and restrict builder-level role assignments - revoke builder access from users who do not need it, as the attack requires that privilege level. There is no network-layer workaround since the endpoint /api/datasources/verify is a legitimate API; blocking it wholesale would disable datasource verification for all users. Self-hosted deployments do not require any action, as the fix preserves TLS file-path passthrough for SELF_HOSTED=true environments.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today