Budibase improperly passes the tlsCertificateKeyFile and tlsCAFile configuration fields directly to the MongoDB driver as filesystem paths without validation or confinement. On Budibase Cloud, where customers cannot place files on the server, this allows a builder to specify arbitrary absolute paths on the multi-tenant server. When verifying the datasource, the MongoDB driver attempts to read these files, causing the server to reveal whether the file exists and, if it does, returning errors indicating file content was read. This creates an arbitrary-path existence and read oracle on the server filesystem accessible via the /api/datasources/verify endpoint. The vulnerability arises from lack of allow-listing, no path confinement, and acceptance of absolute and relative paths with '..'.

An attacker with builder-level access can enumerate arbitrary files on the underlying multi-tenant Budibase Cloud server by observing differing error responses from the datasource verification API. This can expose server configuration files, secrets, and other tenants' files. Additionally, PEM/certificate files can be exfiltrated via mutual-TLS connections to an attacker-controlled MongoDB server. This compromises confidentiality of sensitive server data and potentially other tenants' data in a shared environment.

No official patch or fix is documented in the provided data. Recommended mitigations include disallowing filesystem paths for tlsCertificateKeyFile and tlsCAFile on managed/cloud environments, instead accepting PEM content and writing it to a temporary file in a fixed directory. Absolute and '..' paths should be rejected, and file references confined to an allow-listed certificates directory. Additionally, routing MongoDB connection hosts through SSRF blacklists is advised. Until an official fix is released, restrict builder permissions and avoid using untrusted MongoDB datasource configurations with these fields.